{"record":{"id":"ffc5a3b0c321bdb2","repo":"decolua/9router","slug":"failed-to-uninstall-certificate","errorCode":null,"errorMessage":"Failed to uninstall certificate","messagePattern":"Failed to uninstall certificate","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/mitm/cert/install.js","lineNumber":161,"sourceCode":"  }\n\n  if (IS_WIN) {\n    await uninstallCertWindows();\n  } else if (IS_MAC) {\n    await uninstallCertMac(sudoPassword, certPath);\n  } else {\n    await uninstallCertLinux(sudoPassword);\n  }\n}\n\nasync function uninstallCertMac(sudoPassword, certPath) {\n  const fingerprint = getCertFingerprint(certPath).replace(/:/g, \"\");\n  const command = `security delete-certificate -Z \"${fingerprint}\" /Library/Keychains/System.keychain`;\n  try {\n    await execWithPassword(command, sudoPassword);\n    log(\"🔐 Cert: ✅ uninstalled from system keychain\");\n  } catch (err) {\n    throw new Error(\"Failed to uninstall certificate\");\n  }\n}\n\nasync function uninstallCertWindows() {\n  // Auto-elevate via UAC popup if not admin\n  const script = `certutil -delstore Root ${quotePs(ROOT_CA_CN)}`;\n  try {\n    await runElevatedPowerShell(script);\n    log(\"🔐 Cert: ✅ uninstalled from Windows Root store\");\n  } catch (e) {\n    throw new Error(`Failed to uninstall certificate: ${e.message}`);\n  }\n}\n\nfunction checkCertInstalledLinux() {\n  const config = getLinuxCertConfig();\n  const certFile = `${config.dir}/9router-root-ca.crt`;\n  return Promise.resolve(fs.existsSync(certFile));","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/mitm/cert/install.js#L143-L179","documentation":"uninstallCertMac() computes the cert fingerprint and runs `security delete-certificate -Z <fp> /Library/Keychains/System.keychain` via sudo. Any failure of that command is rethrown as the fixed message 'Failed to uninstall certificate', discarding the underlying error detail.","triggerScenarios":"uninstallCert() on macOS when: sudo password wrong or auth canceled, the cert is not present under that fingerprint, System.keychain is locked, or the terminal lacks permission to modify the keychain.","commonSituations":"Cert already removed manually (delete then fails or behaves unexpectedly); wrong sudo password; managed Mac blocking keychain modification; fingerprint mismatch because the CA was regenerated after install.","solutions":["Retry with the correct sudo password","Check the cert exists: `security find-certificate -c 9router-root-ca /Library/Keychains/System.keychain`","If already removed manually, treat as success and skip uninstall","Manually run `security delete-certificate -Z <fingerprint> /Library/Keychains/System.keychain` to see the raw error"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Check the cert is present before attempting uninstall\nconst installed = await checkCertInstalled(certPath);\nif (!installed) return; // nothing to uninstall, skip","typeGuard":null,"tryCatchPattern":"try {\n  await uninstallCert(sudoPassword, certPath);\n} catch (e) {\n  if (e.message === 'Failed to uninstall certificate') {\n    // re-check; if already gone, treat as success\n    if (!(await checkCertInstalled(certPath))) return;\n    throw e;\n  }\n  throw e;\n}","preventionTips":["Call checkCertInstalled() before uninstalling to avoid pointless sudo prompts","Treat 'already absent' as success (idempotent uninstall)","Keep the CA fingerprint stored so deletion targets the right cert"],"tags":["macos","certificate","keychain","uninstall"],"backgroundTag":"certificate-uninstall-failed","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}