{"record":{"id":"f2b9e03e2df04781","repo":"facebook/docusaurus","slug":"the-certificate-path-cert-path-is-invalid","errorCode":null,"errorMessage":"The certificate path=${cert.path} is invalid.","messagePattern":"The certificate path=(.+?) is invalid\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/docusaurus/src/webpack/utils/getHttpsConfig.ts","lineNumber":24,"sourceCode":" */\n\nimport fs from 'fs-extra';\nimport path from 'path';\nimport crypto from 'crypto';\nimport logger from '@docusaurus/logger';\n\n// Ensure the certificate and key provided are valid and if not\n// throw an easy to debug error.\n//\n// Works for any key type (RSA, ECDSA, EdDSA, ...) — parses both PEMs and\n// checks that the public key embedded in the cert matches the public key\n// derived from the private key.\nfunction validateKeyAndCerts({cert, key}: {cert: CryptoFile; key: CryptoFile}) {\n  let certPublicKey: crypto.KeyObject;\n  try {\n    certPublicKey = new crypto.X509Certificate(cert.content).publicKey;\n  } catch (error) {\n    throw new Error(\n      logger.interpolate`The certificate path=${cert.path} is invalid.`,\n      {cause: error},\n    );\n  }\n\n  let keyPublicKey: crypto.KeyObject;\n  try {\n    keyPublicKey = crypto.createPublicKey(crypto.createPrivateKey(key.content));\n  } catch (error) {\n    throw new Error(\n      logger.interpolate`The certificate key path=${key.path} is invalid.`,\n      {cause: error},\n    );\n  }\n\n  if (!certPublicKey.equals(keyPublicKey)) {\n    throw new Error(\n      logger.interpolate`The certificate path=${cert.path} and key path=${key.path} do not match.`,","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/facebook/docusaurus/blob/3f483e80e326cc646b54b83d564b3f0c4881b9a6/packages/docusaurus/src/webpack/utils/getHttpsConfig.ts#L6-L42","documentation":"Thrown by `validateKeyAndCerts` when `new crypto.X509Certificate(cert.content)` fails to parse the provided certificate. The original parse error is preserved as `cause`. This guards the HTTPS dev server before it tries to use an unreadable cert.","triggerScenarios":"Passing `--ssl-cert` (or `sslCert` in config) pointing to a file that is not a valid PEM/X.509 certificate. The try/catch at getHttpsConfig.ts:21-28 wraps the X509 construction failure.","commonSituations":"Pointing `sslCert` at the private key file by mistake; a cert generated with the wrong format (DER instead of PEM); a truncated/corrupted cert; copy-paste errors dropping the BEGIN/END CERTIFICATE lines.","solutions":["Verify the file is a PEM certificate: `openssl x509 -in cert.pem -noout`.","Ensure `sslCert` and `sslKey` are not swapped.","Regenerate the cert/key pair (e.g. `mkcert localhost` or the Docusaurus HTTPS docs recipe).","Use an absolute path to the cert file."],"exampleFix":"# before\ndocusaurus start --https --ssl-cert ./key.pem --ssl-key ./cert.pem\n# after (swapped correctly)\ndocusaurus start --https --ssl-cert ./cert.pem --ssl-key ./key.pem","handlingStrategy":"validation","validationCode":"const crypto = require('crypto');\nconst fs = require('fs');\nfunction isValidCert(path: string) {\n  try { new crypto.X509Certificate(fs.readFileSync(path)); return true; } catch { return false; }\n}","typeGuard":null,"tryCatchPattern":"try {\n  validateKeyAndCerts({cert, key});\n} catch (e) {\n  if (/certificate path=.* is invalid/.test(e.message)) {\n    console.error('SSL cert unreadable — regenerate with mkcert');\n  }\n  throw e;\n}","preventionTips":["Use `mkcert` to generate a valid PEM cert/key pair.","Validate the cert file with `openssl x509 -in cert.pem -noout` before configuring.","Keep `sslCert` and `sslKey` paths consistent across config and env."],"tags":["https","ssl","dev-server","config"],"backgroundTag":null,"analyzedSha":"3f483e80e326cc646b54b83d564b3f0c4881b9a6","analyzedAt":"2026-08-12T13:25:04.382Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}