{"record":{"id":"ebf41fb654b6ed55","repo":"oven-sh/bun","slug":"cert-signature-failure","errorCode":null,"errorMessage":"CERT_SIGNATURE_FAILURE","messagePattern":"CERT_SIGNATURE_FAILURE","errorType":"error_code","errorClass":"CertError","httpStatus":null,"severity":"error","filePath":"src/http/error.rs","lineNumber":135,"sourceCode":"    Picohttp(bun_picohttp::ParseResponseError),\n}\n\n#[allow(non_camel_case_types)]\n#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]\npub enum CertError {\n    #[error(\"OK\")]\n    OK,\n    #[error(\"UNABLE_TO_GET_ISSUER_CERT\")]\n    UNABLE_TO_GET_ISSUER_CERT,\n    #[error(\"UNABLE_TO_GET_CRL\")]\n    UNABLE_TO_GET_CRL,\n    #[error(\"UNABLE_TO_DECRYPT_CERT_SIGNATURE\")]\n    UNABLE_TO_DECRYPT_CERT_SIGNATURE,\n    #[error(\"UNABLE_TO_DECRYPT_CRL_SIGNATURE\")]\n    UNABLE_TO_DECRYPT_CRL_SIGNATURE,\n    #[error(\"UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY\")]\n    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,\n    #[error(\"CERT_SIGNATURE_FAILURE\")]\n    CERT_SIGNATURE_FAILURE,\n    #[error(\"CRL_SIGNATURE_FAILURE\")]\n    CRL_SIGNATURE_FAILURE,\n    #[error(\"CERT_NOT_YET_VALID\")]\n    CERT_NOT_YET_VALID,\n    #[error(\"CERT_HAS_EXPIRED\")]\n    CERT_HAS_EXPIRED,\n    #[error(\"CRL_NOT_YET_VALID\")]\n    CRL_NOT_YET_VALID,\n    #[error(\"CRL_HAS_EXPIRED\")]\n    CRL_HAS_EXPIRED,\n    #[error(\"ERROR_IN_CERT_NOT_BEFORE_FIELD\")]\n    ERROR_IN_CERT_NOT_BEFORE_FIELD,\n    #[error(\"ERROR_IN_CERT_NOT_AFTER_FIELD\")]\n    ERROR_IN_CERT_NOT_AFTER_FIELD,\n    #[error(\"ERROR_IN_CRL_LAST_UPDATE_FIELD\")]\n    ERROR_IN_CRL_LAST_UPDATE_FIELD,\n    #[error(\"ERROR_IN_CRL_NEXT_UPDATE_FIELD\")]","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/http/error.rs#L117-L153","documentation":"X509 verify result 7 (X509_V_ERR_CERT_SIGNATURE_FAILURE): the certificate's signature is present and decryptable but invalid — the computed digest does not match, meaning the cert was altered or not signed by the claimed issuer. Mapped via get_cert_error_from_no (src/http/lib.rs:1526) to CertError::CERT_SIGNATURE_FAILURE, message \"certificate signature failure\" (FetchTasklet.rs:1391).","triggerScenarios":"TLS handshake where the leaf or an intermediate fails cryptographic signature verification — tampered cert bytes, a forged cert, or an issuer/leaf mismatch that still parses.","commonSituations":"A certificate regenerated with the same subject but not re-signed by the CA while the old intermediate is served, MITM tampering, corrupted cert files after deployment, or exotic signature algorithms the verifier computes differently.","solutions":["Re-issue and redeploy a fresh certificate+chain from the CA and retest","Verify the exact pair locally: openssl verify -CAfile <(cat intermediate.pem root.pem) leaf.pem","Compare served bytes with the file on disk (openssl s_client -showcerts) to catch deployment corruption","Investigate possible interception if the failure appears only on one network path"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isCertErrorCode(e: unknown, code = \"CERT_SIGNATURE_FAILURE\"): e is Error & { code: string } {\n  return e instanceof Error && (e as any).code === code;\n}","tryCatchPattern":"try {\n  await fetch(url);\n} catch (e) {\n  if (isCertErrorCode(e, \"CERT_SIGNATURE_FAILURE\")) {\n    // cryptographic mismatch or tampering — do NOT bypass; alert security/ops\n    throw new Error(\"Peer certificate failed signature verification\");\n  }\n  throw e;\n}","preventionTips":["Redeploy certs atomically (leaf + intermediate from the same issuance) after rotation","Treat sudden CERT_SIGNATURE_FAILURE on previously-working hosts as a possible MITM and investigate","Verify chains in deployment pipelines: openssl verify -CAfile chain.pem leaf.pem"],"tags":["tls","certificates","pkix","security","fetch"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}