{"record":{"id":"9cc5f4da8fcd3835","repo":"oven-sh/bun","slug":"invalidcafile","errorCode":null,"errorMessage":"InvalidCAFile","messagePattern":"InvalidCAFile","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/http/InitError.rs","lineNumber":7,"sourceCode":"#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]\npub enum InitError {\n    #[error(\"FailedToOpenSocket\")]\n    FailedToOpenSocket,\n    #[error(\"LoadCAFile\")]\n    LoadCAFile,\n    #[error(\"InvalidCAFile\")]\n    InvalidCAFile,\n    #[error(\"InvalidCA\")]\n    InvalidCA,\n    #[error(\"InvalidCRL\")]\n    InvalidCRL,\n}\n","sourceCodeStart":1,"sourceCodeEnd":14,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/InitError.rs#L1-L14","documentation":"The CA file was found and read, but its content is not a usable certificate bundle (uws invalid_ca_file mapped at src/http/HTTPContext.rs:519; fatal message 'the CA file is invalid' at src/http/HTTPThread.rs:362-368). BoringSSL could not parse it as PEM CA material — wrong format, stray text, or a private key where a cert belongs.","triggerScenarios":"`cafile` points to a DER-encoded .cer (binary) instead of PEM, to a PEM containing a private key or CSR rather than CA certificates, to a file with smart-quote/copy-paste corruption of the BEGIN/END markers, or to an HTML error page saved as .pem.","commonSituations":"Exporting a cert from Windows certmgr as DER and using it directly; concatenating bundles with a missing newline so footer/header collide; files edited by rich-text editors inserting BOM/zero-width chars; artifact-proxy corrupted downloads.","solutions":["Validate the bundle before use: `openssl x509 -in ca.pem -noout -subject` (or `openssl crl2pkcs7 -nocrl -certfile ca.pem | openssl pkcs7 -print_certs -noout` for multi-cert bundles).","Convert DER to PEM if needed: `openssl x509 -inform der -in ca.cer -out ca.pem`.","Rebuild the bundle ensuring each block is a complete `-----BEGIN CERTIFICATE-----`/`-----END CERTIFICATE-----` pair separated by newlines.","Confirm the file contains certificates, not keys: `grep -c 'BEGIN CERTIFICATE' ca.pem` should be >= 1 and `grep 'PRIVATE KEY' ca.pem` empty."],"exampleFix":"# before: DER file passed directly\n[install]\ncafile = \"corp-ca.cer\"   # binary DER -> InvalidCAFile\n# after: convert to PEM first\nopenssl x509 -inform der -in corp-ca.cer -out corp-ca.pem\n# bunfig.toml\n[install]\ncafile = \"corp-ca.pem\"","handlingStrategy":"validation","validationCode":"import { execSync } from 'node:child_process';\n// Multi-cert bundles: parse every PEM block\nexecSync(`openssl crl2pkcs7 -nocrl -certfile ca.pem | openssl pkcs7 -print_certs -noout`, { stdio: 'pipe' });\n// throws if the file is not valid PEM CA material","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Export certs as PEM (base64), never DER, for cafile","When concatenating bundles, keep one clean newline between PEM blocks","Validate the bundle in CI wherever the CA file is produced or refreshed"],"tags":["tls","ca","pem","config","crash"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}