{"record":{"id":"b81ca85d9591aa2a","repo":"oven-sh/bun","slug":"failedtoopensocket","errorCode":null,"errorMessage":"FailedToOpenSocket","messagePattern":"FailedToOpenSocket","errorType":"error_code","errorClass":"InitError","httpStatus":null,"severity":"critical","filePath":"src/http/InitError.rs","lineNumber":3,"sourceCode":"#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]\npub enum InitError {\n    #[error(\"FailedToOpenSocket\")]\n    FailedToOpenSocket,\n    #[error(\"LoadCAFile\")]\n    LoadCAFile,\n    #[error(\"InvalidCAFile\")]\n    InvalidCAFile,\n    #[error(\"InvalidCA\")]\n    InvalidCA,\n    #[error(\"InvalidCRL\")]\n    InvalidCRL,\n}\n","sourceCodeStart":1,"sourceCodeEnd":14,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/InitError.rs#L1-L14","documentation":"The TLS socket context for Bun's HTTP client thread could not be created for a reason not covered by the CA-specific variants (src/http/HTTPContext.rs:522-526): invalid cipher list, invalid ECDH curve, or an unspecified failure; it is also the mapping target for raw uSockets connect errors (From<ConnectError>, src/http/error.rs:357-361). The default init handler prints 'failed to start HTTP client thread' and calls Global::crash() — the process exits (src/http/HTTPThread.rs:375-379).","triggerScenarios":"Configuring fetch/Bun.install TLS options with a cipher string BoringSSL rejects or an unsupported ecdhCurve; fd/memory exhaustion at context creation; any uws connect failure mapping through ConnectError. Surfaced at the first HTTPS request or `bun install` run.","commonSituations":"Copying Node's `ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:...'` config that includes ciphers BoringSSL dropped; setting an ecdhCurve name not compiled into the TLS stack; heavily sandboxed CI with strict rlimits on memory or file descriptors.","solutions":["Remove or simplify custom `ciphers`/`ecdhCurve` TLS options — Bun's BoringSSL defaults are correct for nearly all servers.","Validate any cipher list with BoringSSL semantics (`openssl ciphers '<string>'` is approximate; prefer Bun defaults).","If in CI, raise fd/memory limits or run outside the sandbox to see if context creation succeeds.","Update Bun — mappings and defaults for socket-context failures have improved across releases."],"exampleFix":"// before\nawait fetch('https://example.com', { tls: { ciphers: 'DES-CBC3-SHA:RC4-SHA' } }); // BoringSSL rejects\n// after: rely on defaults\nawait fetch('https://example.com');","handlingStrategy":"validation","validationCode":"// Before configuring custom TLS, sanity-check the cipher suite string\nimport { execSync } from 'node:child_process';\nfunction ciphersLookValid(list) {\n  try { return execSync(`openssl ciphers '${list}'`, { stdio: 'pipe' }).toString().trim().length > 0; }\n  catch { return false; }\n}\nconst opts = ciphersLookVectorSafe => ciphersLookValid(CIPHERS) ? { tls: { ciphers: CIPHERS } } : {};","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default TLS options work — add ciphers/ecdhCurve overrides only when a specific server demands it","Test TLS config changes in a disposable CI job first: this error crashes the whole process","Keep fd/memory limits generous in sandboxes where the HTTP client thread starts"],"tags":["http","tls","network","crash","boringssl"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}