{"record":{"id":"f75655febf2f315b","repo":"react/create-react-app","slug":"the-certificate-crtfile-is-invalid-n-err-me","errorCode":null,"errorMessage":"The certificate \"${crtFile}\" is invalid.\\n${err.message}","messagePattern":"The certificate \"(.+?)\" is invalid\\.\\\\n(.+?)","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/react-scripts/config/getHttpsConfig.js","lineNumber":25,"sourceCode":" */\n// @remove-on-eject-end\n'use strict';\n\nconst fs = require('fs');\nconst path = require('path');\nconst crypto = require('crypto');\nconst chalk = require('react-dev-utils/chalk');\nconst paths = require('./paths');\n\n// Ensure the certificate and key provided are valid and if not\n// throw an easy to debug error\nfunction validateKeyAndCerts({ cert, key, keyFile, crtFile }) {\n  let encrypted;\n  try {\n    // publicEncrypt will throw an error with an invalid cert\n    encrypted = crypto.publicEncrypt(cert, Buffer.from('test'));\n  } catch (err) {\n    throw new Error(\n      `The certificate \"${chalk.yellow(crtFile)}\" is invalid.\\n${err.message}`\n    );\n  }\n\n  try {\n    // privateDecrypt will throw an error with an invalid key\n    crypto.privateDecrypt(key, encrypted);\n  } catch (err) {\n    throw new Error(\n      `The certificate key \"${chalk.yellow(keyFile)}\" is invalid.\\n${\n        err.message\n      }`\n    );\n  }\n}\n\n// Read file and throw an error if it doesn't exist\nfunction readEnvFile(file, type) {","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/react/create-react-app/blob/6254386531d263688ccfa542d0e628fbc0de0b28/packages/react-scripts/config/getHttpsConfig.js#L7-L43","documentation":"getHttpsConfig.validateKeyAndCerts sanity-checks the user-supplied SSL certificate by encrypting a test buffer with crypto.publicEncrypt. If that throws, the cert cannot be used for HTTPS and the error is re-thrown with the path (crtFile) and the underlying OpenSSL message. This prevents webpack-dev-server starting with a broken cert.","triggerScenarios":"SSL_CRT_FILE is set in .env to a file whose contents are not a valid PEM/X.509 certificate (malformed, wrong format, expired to the point of rejection, or partially written). crypto.publicEncrypt throws and the catch re-wraps it.","commonSituations":"Generating a cert with the wrong command/format. Copying only part of a PEM file. Editing the cert and introducing whitespace/encoding errors. Pointing SSL_CRT_FILE at the key file by mistake.","solutions":["Regenerate a valid self-signed cert, e.g. `mkcert localhost` or `openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365`.","Verify the file at SSL_CRT_FILE is a complete PEM cert: it begins with `-----BEGIN CERTIFICATE-----` and ends with the matching footer.","Ensure SSL_CRT_FILE and SSL_KEY_FILE are not swapped.","Confirm the cert encoding is PEM (base64), not DER/binary; convert if needed: `openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM`."],"exampleFix":"# before\nSSL_CRT_FILE=./cert.txt        # malformed\nSSL_KEY_FILE=./key.pem\n# after\nSSL_CRT_FILE=./cert.pem        # valid PEM cert\nSSL_KEY_FILE=./key.pem","handlingStrategy":"validation","validationCode":"const fs = require('fs');\nconst crypto = require('crypto');\nfunction validateCertFile(crtFile) {\n  const cert = fs.readFileSync(crtFile);\n  try {\n    crypto.publicEncrypt(cert, Buffer.from('test'));\n  } catch (e) {\n    throw new Error(`SSL_CRT_FILE '${crtFile}' is not a valid cert: ${e.message}`);\n  }\n}\n// before starting dev server:\nif (process.env.SSL_CRT_FILE) validateCertFile(process.env.SSL_CRT_FILE);","typeGuard":"const looksLikePemCert = (contents) =>\n  /-----BEGIN CERTIFICATE-----/.test(contents) &&\n  /-----END CERTIFICATE-----/.test(contents);","tryCatchPattern":"try {\n  require('react-scripts/config/getHttpsConfig');\n} catch (e) {\n  if (/certificate .* is invalid/i.test(e.message)) {\n    console.error('SSL_CRT_FILE is invalid. Regenerate with mkcert or openssl.');\n    process.exit(1);\n  }\n  throw e;\n}","preventionTips":["Use mkcert to generate trusted local certs (it produces a matched pair).","Keep cert and key as a pair; regenerate both together.","Validate cert files with `openssl x509 -in cert.pem -noout -text` before referencing them.","Don't edit PEM files by hand; whitespace breaks parsing."],"tags":["https","ssl","certificate","crypto","config"],"backgroundTag":null,"analyzedSha":"6254386531d263688ccfa542d0e628fbc0de0b28","analyzedAt":"2026-08-12T22:55:01.751Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}