{"record":{"id":"b789fe5972ecaeee","repo":"decolua/9router","slug":"sudo-password-required-to-trust-certificate","errorCode":null,"errorMessage":"Sudo password required to trust certificate","messagePattern":"Sudo password required to trust certificate","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/mitm/manager.js","lineNumber":855,"sourceCode":"  const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();\n  await removeDNSEntry(tool, password);\n  await saveDnsToolState(tool, false);\n  return { success: true };\n}\n\n/**\n * Install Root CA to system trust store (standalone, no server start)\n */\nasync function trustCert(sudoPassword) {\n  const rootCACertPath = path.join(MITM_DIR, \"rootCA.crt\");\n  if (!fs.existsSync(rootCACertPath)) throw new Error(\"Root CA not found. Start server first to generate it.\");\n  const { installCert } = require(\"./cert/install\");\n  if (!IS_WIN && !IS_MAC && !isSudoAvailable()) {\n    log(`🔐 Cert: system trust unavailable (no sudo). Use file: ${rootCACertPath}`);\n    return;\n  }\n  const password = sudoPassword || getCachedPassword() || await loadEncryptedPassword();\n  if (!password && isSudoPasswordRequired()) throw new Error(\"Sudo password required to trust certificate\");\n  await installCert(password, rootCACertPath);\n  if (password) setCachedPassword(password);\n}\n\n// Legacy aliases for backward compatibility\nconst startMitm = startServer;\nconst stopMitm = stopServer;\n\nmodule.exports = {\n  getMitmStatus,\n  startServer,\n  stopServer,\n  enableToolDNS,\n  disableToolDNS,\n  trustCert,\n  // Legacy\n  startMitm,\n  stopMitm,","sourceCodeStart":837,"sourceCodeEnd":873,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/mitm/manager.js#L837-L873","documentation":"trustCert() needs elevated privileges to write into the system trust store, and on platforms where a password is mandatory (isSudoPasswordRequired()) it throws when no sudo password could be obtained from the argument, the in-memory cache, or the encrypted store. The earlier isSudoAvailable() guard only covers non-Windows/non-macOS; this check covers the password itself.","triggerScenarios":"Calling trustCert() with no sudoPassword argument when no password is cached and loadEncryptedPassword() returns null/falsy while isSudoPasswordRequired() is true.","commonSituations":"Fresh install where the user never saved a sudo password; password cache expired; automation calling trustCert() without passing credentials; user previously declined to store the password encrypted.","solutions":["Pass the sudo password explicitly: trustCert(process.env.SUDO_PASSWORD) or from user input","Save the password once via the app's credential flow so loadEncryptedPassword() can retrieve it","If not on a system requiring sudo (Windows/macOS paths differ), the guard may not apply — check isSudoPasswordRequired()","On Linux without stored credentials, manually trust rootCA.crt with sudo cp/update-ca-certificates"],"exampleFix":"// before\nawait trustCert(); // no password available\n// after\nconst password = sudoPassword || (await promptForSudoPassword());\nif (!password) throw new Error(\"Cannot trust cert without sudo password\");\nawait trustCert(password);","handlingStrategy":"validation","validationCode":"const password = sudoPassword || getCachedPassword() || (await loadEncryptedPassword());\nif (!password && isSudoPasswordRequired()) {\n  throw new Error(\"Collect sudo password before calling trustCert\");\n}\nawait trustCert(password);","typeGuard":"function hasSudoCredential(p) { return typeof p === \"string\" && p.length > 0; }","tryCatchPattern":"try {\n  await trustCert(sudoPassword);\n} catch (err) {\n  if (err.message.includes(\"Sudo password required\")) {\n    const pw = await promptUserForSudoPassword();\n    if (pw) await trustCert(pw);\n  } else throw err;\n}","preventionTips":["Prompt for and securely store the sudo password during onboarding","Check isSudoPasswordRequired() before calling cert install functions","Never rely on the cache alone — it may be empty on a fresh process","On Linux CI, prefer manually trusting rootCA.crt instead of interactive sudo"],"tags":["mitm","certificate","sudo","permissions"],"backgroundTag":"sudo-password-required","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}