{"record":{"id":"93302ea3693293da","repo":"gatsbyjs/gatsby","slug":"11522","errorCode":"11522","errorMessage":"Failed to generate dev SSL certificate","messagePattern":"Failed to generate dev SSL certificate","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/gatsby/src/utils/get-ssl-cert.ts","lineNumber":105,"sourceCode":"      process.env.HOME = mkdtemp\n    }\n    const getDevCert = require(`@expo/devcert`).certificateFor\n    const { caPath, key, cert } = await getDevCert(name, {\n      getCaPath: true,\n      skipCertutilInstall: false,\n      ui: {\n        getWindowsEncryptionPassword,\n      },\n    })\n    if (caPath) {\n      process.env.NODE_EXTRA_CA_CERTS = caPath\n    }\n    return {\n      key: key.toString(),\n      cert: cert.toString(),\n    }\n  } catch (err) {\n    report.panic({\n      id: `11522`,\n      error: err,\n      context: {\n        message: err.message,\n      },\n    })\n  }\n\n  return false\n}\n","sourceCodeStart":87,"sourceCodeEnd":116,"githubUrl":"https://github.com/gatsbyjs/gatsby/blob/8b06340921ffdf23125a365b9c9923690cb62ce6/packages/gatsby/src/utils/get-ssl-cert.ts#L87-L116","documentation":"Thrown when Gatsby's automatic dev-SSL path fails. After confirming no custom cert/key were provided, getSslCert delegates to `@expo/devcert`'s `certificateFor` to generate and trust a local CA. If that call rejects (permission error, missing certutil, Windows keychain access denied, corrupted devcert config dir, HOME not writable), the catch block panics with the underlying error's message.","triggerScenarios":"Running `gatsby develop --https` (no custom cert/key) on an environment where @expo/devcert cannot install its CA, cannot write to its config directory, or cannot elevate privileges. Also triggered when process.env.HOME had to be faked to a tmpdir that devcert then cannot use persistently.","commonSituations":"First-time HTTPS setup on Linux without `libnss3`/`certutil` installed; running inside a container as a non-root user without write access to the devcert config path; macOS Keychain or Windows credential prompt denied/cancelled; CI runners where no sudo/interactive elevation is possible; corrupted `~/.config/devcert` or `~/.cache/devcert`.","solutions":["Install the system cert tooling devcert needs: `sudo apt-get install libnss3-tools` (Linux) or ensure `certutil` is on PATH.","Provide your own pre-generated cert to bypass automatic generation: `gatsby develop --https --cert-file cert.pem --key-file key.pem`.","Remove the corrupted devcert state dir (e.g. `rm -rf ~/.config/devcert ~/.cache/devcert`) and retry so devcert re-initializes its CA.","Run with sufficient privileges or in an interactive shell so the trust prompt can complete; in CI prefer a committed custom cert.","Ensure HOME is set and writable (`echo $HOME`) before launching."],"exampleFix":"// before\ngatsby develop --https\n// after (skip auto-generation with a committed cert)\ngatsby develop --https --cert-file ./cert.pem --key-file ./key.pem","handlingStrategy":"fallback","validationCode":"// Preflight checks before relying on automatic devcert generation.\nconst os = require('os')\nconst fs = require('fs')\nfunction devcertPreflight() {\n  const problems = []\n  if (['linux','darwin'].includes(os.platform()) && (!process.env.HOME || !fs.existsSync(process.env.HOME))) {\n    problems.push('HOME is unset or missing; devcert cannot initialize its config dir.')\n  }\n  if (os.platform() === 'linux') {\n    try { require('child_process').execSync('command -v certutil', { stdio: 'ignore' }) }\n    catch { problems.push('certutil not found; install libnss3-tools for devcert trust.') }\n  }\n  return problems\n}","typeGuard":null,"tryCatchPattern":"// Fall back to a provided custom cert when auto-generation is unavailable.\ntry {\n  cert = await getSslCert({ name, directory })\n} catch (e) {\n  if (process.env.GATSBY_CERT_FILE && process.env.GATSBY_KEY_FILE) {\n    cert = await getSslCert({ name, directory, certFile: process.env.GATSBY_CERT_FILE, keyFile: process.env.GATSBY_KEY_FILE })\n  } else { throw e }\n}","preventionTips":["Ship a pre-generated cert+key for CI and pass them explicitly.","Install libnss3-tools on Linux dev images so devcert can install its CA.","Keep a writable HOME; never run with HOME unset in containers.","Clear ~/.config/devcert when errors recur after environment fixes."],"tags":["ssl","https","dev-server","devcert","permissions","ci"],"backgroundTag":null,"analyzedSha":"8b06340921ffdf23125a365b9c9923690cb62ce6","analyzedAt":"2026-08-13T02:36:21.405Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}