{"record":{"id":"f32dc714436cf2bb","repo":"openai/codex","slug":"startup-ca-bundle-contained-an-invalid-trusted-cer","errorCode":null,"errorMessage":"startup CA bundle contained an invalid trusted certificate: {}","messagePattern":"startup CA bundle contained an invalid trusted certificate: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"codex-rs/network-proxy/src/certs.rs","lineNumber":349,"sourceCode":"    let contains_trusted_certificates = pem.contains(\"TRUSTED CERTIFICATE\");\n    let normalized_pem = pem\n        .replace(\"BEGIN TRUSTED CERTIFICATE\", \"BEGIN CERTIFICATE\")\n        .replace(\"END TRUSTED CERTIFICATE\", \"END CERTIFICATE\");\n    let certs = CertificateDer::pem_slice_iter(normalized_pem.as_bytes())\n        .collect::<std::result::Result<Vec<_>, _>>()\n        .with_context(|| format!(\"failed to parse startup CA bundle: {}\", path.display()))?;\n    if certs.is_empty() {\n        return Err(anyhow!(\n            \"startup CA bundle contained no certificates: {}\",\n            path.display()\n        ));\n    }\n    certs\n        .into_iter()\n        .map(|cert| {\n            let cert = if contains_trusted_certificates {\n                first_der_item(cert.as_ref()).ok_or_else(|| {\n                    anyhow!(\n                        \"startup CA bundle contained an invalid trusted certificate: {}\",\n                        path.display()\n                    )\n                })?\n            } else {\n                cert.as_ref()\n            };\n            Ok(CertificateDer::from(cert.to_vec()))\n        })\n        .collect()\n}\n\nfn load_ca_directory_certificates(path: &Path) -> Vec<CertificateDer<'static>> {\n    let rustls_native_certs::CertificateResult { certs, errors, .. } =\n        rustls_native_certs::load_certs_from_paths(None, Some(path));\n    if !errors.is_empty() {\n        warn!(\n            ca_path = %path.display(),","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/network-proxy/src/certs.rs#L331-L367","documentation":"Error \"startup CA bundle contained an invalid trusted certificate: {}\" thrown in openai/codex.","triggerScenarios":"Thrown at codex-rs/network-proxy/src/certs.rs:349 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}