{"record":{"id":"d8ec0527efbe0d72","repo":"openai/codex","slug":"failed-to-sign-host-cert-err","errorCode":null,"errorMessage":"failed to sign host cert: {err}","messagePattern":"failed to sign host cert: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/network-proxy/src/certs.rs","lineNumber":144,"sourceCode":"            .map_err(|err| anyhow!(\"failed to create cert params: {err}\"))?;\n        params.subject_alt_names.push(SanType::IpAddress(ip));\n        params\n    } else {\n        CertificateParams::new(vec![host.to_string()])\n            .map_err(|err| anyhow!(\"failed to create cert params: {err}\"))?\n    };\n\n    params.extended_key_usages = vec![ExtendedKeyUsagePurpose::ServerAuth];\n    params.key_usages = vec![\n        KeyUsagePurpose::DigitalSignature,\n        KeyUsagePurpose::KeyEncipherment,\n    ];\n\n    let key_pair = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)\n        .map_err(|err| anyhow!(\"failed to generate host key pair: {err}\"))?;\n    let cert = params\n        .signed_by(&key_pair, issuer)\n        .map_err(|err| anyhow!(\"failed to sign host cert: {err}\"))?;\n\n    Ok((cert.pem(), key_pair.serialize_pem()))\n}\n\nconst MANAGED_MITM_CA_DIR: &str = \"proxy\";\nconst MANAGED_MITM_CA_ARTIFACT_LOCK: &str = \".artifacts.lock\";\nconst MANAGED_MITM_CA_CERT_PREFIX: &str = \"ca\";\nconst MANAGED_MITM_CA_TRUST_BUNDLE_PREFIX: &str = \"ca-bundle\";\npub(crate) const SSL_CERT_DIR_ENV_KEY: &str = \"SSL_CERT_DIR\";\n\n// Best-effort compatibility set for common child toolchains that accept a CA bundle path.\n// This is intentionally curated rather than pretending to cover every TLS client.\npub const CUSTOM_CA_ENV_KEYS: [&str; 11] = [\n    \"CODEX_CA_CERTIFICATE\",\n    \"SSL_CERT_FILE\",\n    \"REQUESTS_CA_BUNDLE\",\n    \"CURL_CA_BUNDLE\",\n    \"NODE_EXTRA_CA_CERTS\",","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/network-proxy/src/certs.rs#L126-L162","documentation":"Error \"failed to sign host cert: {err}\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/network-proxy/src/certs.rs:144 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}