{"record":{"id":"b37432b59e893e59","repo":"hatoo/oha","slug":"could-not-load-platform-certs","errorCode":null,"errorMessage":"could not load platform certs","messagePattern":"could not load platform certs","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/tls_config.rs","lineNumber":19,"sourceCode":"#[cfg(feature = \"rustls\")]\npub struct RuslsConfigs {\n    no_alpn: std::sync::Arc<rustls::ClientConfig>,\n    alpn_h2: std::sync::Arc<rustls::ClientConfig>,\n    alpn_h3: std::sync::Arc<rustls::ClientConfig>,\n}\n\n#[cfg(feature = \"rustls\")]\nimpl RuslsConfigs {\n    pub fn new(\n        insecure: bool,\n        cacert_pem: Option<&[u8]>,\n        client_auth: Option<(&[u8], &[u8])>,\n    ) -> Self {\n        use rustls_pki_types::pem::PemObject;\n        use std::sync::Arc;\n\n        let mut root_cert_store = rustls::RootCertStore::empty();\n        for cert in rustls_native_certs::load_native_certs().expect(\"could not load platform certs\")\n        {\n            root_cert_store.add(cert).unwrap();\n        }\n\n        if let Some(cacert_pem) = cacert_pem {\n            for der in rustls_pki_types::CertificateDer::pem_slice_iter(cacert_pem) {\n                root_cert_store.add(der.unwrap()).unwrap();\n            }\n        }\n\n        let _ = rustls::crypto::CryptoProvider::install_default(\n            rustls::crypto::aws_lc_rs::default_provider(),\n        );\n        let builder = rustls::ClientConfig::builder().with_root_certificates(root_cert_store);\n\n        let mut config = if let Some((cert, key)) = client_auth {\n            let certs = rustls_pki_types::CertificateDer::pem_slice_iter(cert)\n                .collect::<Result<Vec<_>, _>>()","sourceCodeStart":1,"sourceCodeEnd":37,"githubUrl":"https://github.com/hatoo/oha/blob/4efba2d113d165aaaf7533f5d2893e7cc57ebfc1/src/tls_config.rs#L1-L37","documentation":"RuslsConfigs::new calls load_native_certs() and unwraps with this panic message when the rustls-native-certs crate cannot load the platform's certificate store (unreadable /etc/ssl/certs on Linux, missing Keychain access on macOS, or a corrupted store). Since it is an expect(), it aborts configuration at startup rather than returning an error.","triggerScenarios":"Thrown at src/tls_config.rs:19 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the platform CA bundle exists and is readable (e.g. /etc/ssl/certs/ca-certificates.crt on Debian/Ubuntu; install ca-certificates if missing).","On macOS, verify keychain access permissions for the process.","Supply a CA bundle explicitly via the cacert_pem option to bypass native cert loading.","Debug the underlying load_native_certs() error, which expect() discards."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4efba2d113d165aaaf7533f5d2893e7cc57ebfc1","analyzedAt":"2026-09-09T16:24:23.306Z","contentChangedAt":"2026-09-09T16:24:23.306Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}