{"record":{"id":"b8d4a0f5cf27a715","repo":"we-promise/sure","slug":"ssl-could-not-find-system-ca-bundle-using-cust","errorCode":null,"errorMessage":"[SSL] Could not find system CA bundle - using custom CA only","messagePattern":"\\[SSL\\] Could not find system CA bundle - using custom CA only","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"config/initializers/00_ssl.rb","lineNumber":160,"sourceCode":"        bundle_path = File.join(openssl_ca_dir, bundle_name)\n        return bundle_path if File.exist?(bundle_path) && File.readable?(bundle_path)\n      end\n    end\n\n    nil\n  end\n\n  # Creates a combined CA bundle with system CAs and custom CA.\n  # Writes to a predictable path (tmp/ssl_ca_bundle.pem) for easy debugging\n  # and to avoid Tempfile GC lifecycle issues.\n  #\n  # @param custom_ca_path [String] Path to the custom CA certificate\n  # @param output_path [String] Where to write the combined bundle\n  # @return [String, nil] Path to the combined bundle, or nil on failure\n  def create_combined_ca_bundle(custom_ca_path, output_path: COMBINED_CA_BUNDLE_PATH)\n    system_ca = find_system_ca_bundle\n    unless system_ca\n      Rails.logger.warn(\"[SSL] Could not find system CA bundle - using custom CA only\")\n      return nil\n    end\n\n    begin\n      system_content = File.read(system_ca)\n      custom_content = File.read(custom_ca_path)\n\n      # Ensure the parent directory exists\n      FileUtils.mkdir_p(File.dirname(output_path))\n\n      File.write(output_path, system_content + \"\\n# Custom CA Certificate\\n\" + custom_content)\n\n      Rails.logger.info(\"[SSL] Created combined CA bundle: #{output_path}\")\n      Rails.logger.info(\"[SSL]   - System CA source: #{system_ca}\")\n      Rails.logger.info(\"[SSL]   - Custom CA source: #{custom_ca_path}\")\n\n      output_path.to_s\n    rescue StandardError => e","sourceCodeStart":142,"sourceCodeEnd":178,"githubUrl":"https://github.com/we-promise/sure/blob/e69894adb92547273377398c15f45c979cd9416a/config/initializers/00_ssl.rb#L142-L178","documentation":"Log warning from SslInitializerHelper#create_combined_ca_bundle (config/initializers/00_ssl.rb:160) when find_system_ca_bundle locates no system CA bundle path (none of the known distro locations like /etc/ssl/certs/ca-certificates.crt exists or is readable). The helper then returns nil and the caller falls back to trusting only the custom CA, meaning TLS connections to public services (whose chains root in system CAs) may fail verification.","triggerScenarios":"Booting the app in a minimal container (alpine/distroless/slim) that lacks the ca-certificates package, or on a host with a non-standard CA path, while a custom CA (SSL_CA_FILE-style config) is set.","commonSituations":"Docker images built without ca-certificates; hardened servers where /etc/ssl was trimmed; local dev boxes using OpenSSL in a Homebrew/Macports prefix the helper does not probe.","solutions":["Install system CA certificates in the image/host: apt-get install -y ca-certificates (Debian/Ubuntu) or apk add ca-certificates (Alpine), then restart.","Point the config at an explicit bundle path if your distro keeps it elsewhere, so find_system_ca_bundle succeeds.","Verify afterwards: the log should show the combined bundle at tmp/ssl_ca_bundle.pem and SSL_CERT_FILE set to it.","As a stopgap, understand the fallback: only endpoints whose chain terminates in your custom CA will verify."],"exampleFix":"// before\n# Dockerfile (no system CAs) -> warning + public TLS failures\n\n// after\nRUN apt-get update && apt-get install -y --no-install-recommends ca-certificates","handlingStrategy":"fallback","validationCode":"SYSTEM_CA_PATHS = %w[/etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt]\nSYSTEM_CA_PATHS.any? { |p| File.readable?(p) }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Install ca-certificates in base container images before adding the app layer.","Verify the bundle exists once, in an image build check, rather than diagnosing at boot.","If a custom CA is configured, always confirm the combined-bundle log line appears at startup."],"tags":["ssl","tls","ca-certificates","docker","startup-warning"],"backgroundTag":"missing-system-ca-bundle","analyzedSha":"e69894adb92547273377398c15f45c979cd9416a","analyzedAt":"2026-08-21T18:22:41.165Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}