appsmithorg/appsmith · error · Error

The certificate "${crtFile}" is invalid.\n${err.message}

Error message

The certificate "${crtFile}" is invalid.\n${err.message}

What it means

Thrown by config/getHttpsConfig.js during the local dev-server HTTPS setup. validateKeyAndCerts() calls crypto.publicEncrypt(cert, ...) as a sanity check; a malformed, expired, wrong-format, or non-X.509 certificate makes publicEncrypt throw, which is re-wrapped with the offending file path. The message embeds the original crypto error (err.message) so you can see the precise parse failure.

Source

Thrown at app/client/config/getHttpsConfig.js:17

'use strict';

const fs = require('fs');
const path = require('path');
const crypto = require('crypto');
const chalk = require('react-dev-utils/chalk');
const paths = require('./paths');

// Ensure the certificate and key provided are valid and if not
// throw an easy to debug error
function validateKeyAndCerts({ cert, key, keyFile, crtFile }) {
  let encrypted;
  try {
    // publicEncrypt will throw an error with an invalid cert
    encrypted = crypto.publicEncrypt(cert, Buffer.from('test'));
  } catch (err) {
    throw new Error(
      `The certificate "${chalk.yellow(crtFile)}" is invalid.\n${err.message}`
    );
  }

  try {
    // privateDecrypt will throw an error with an invalid key
    crypto.privateDecrypt(key, encrypted);
  } catch (err) {
    throw new Error(
      `The certificate key "${chalk.yellow(keyFile)}" is invalid.\n${
        err.message
      }`
    );
  }
}

// Read file and throw an error if it doesn't exist
function readEnvFile(file, type) {

View on GitHub (pinned to 8cd9021c24)

Solutions

1. Regenerate a valid self-signed cert: 'mkcert localhost 127.0.0.1 ::1' or 'openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365'.
2. Verify the file is PEM-formatted X.509: 'openssl x509 -in $SSL_CRT_FILE -text -noout' must succeed without error.
3. Confirm SSL_CRT_FILE points to the leaf certificate (BEGIN CERTIFICATE), not the private key or a CSR.
4. Strip any BOM/CRLF: 'sed -i "s/\r$//" cert.pem' and re-save as UTF-8 without BOM.

Example fix

# before
SSL_CRT_FILE=./cert.csr SSL_KEY_FILE=./key.pem HTTPS=true npm start
# -> The certificate "./cert.csr" is invalid.

# after
SSL_CRT_FILE=./cert.pem SSL_KEY_FILE=./key.pem HTTPS=true npm start

const fs = require('fs');
const { SSL_CRT_FILE } = process.env;
if (SSL_CRT_FILE) {
  const { execSync } = require('child_process');
  execSync(`openssl x509 -in "${SSL_CRT_FILE}" -noout`, { stdio: 'pipe' });
}

try { getHttpsConfig(); } catch (e) {
  if (/certificate .* is invalid/i.test(e.message)) { /* prompt to regenerate cert */ }
  else throw e;
}

When it happens

Trigger: Starting the dev server with HTTPS=true and SSL_CRT_FILE pointing at a certificate that is not valid PEM/X.509, is corrupted, is a CA bundle instead of a leaf cert, or uses an unsupported key algorithm. crypto.publicEncrypt fails on the first malformed cert in the chain.

Common situations: Self-signed certs generated with wrong openssl flags; cert files saved with CRLF or BOM corruption; pointing SSL_CRT_FILE at a .key or .csr by mistake; certs generated for a different key type (e.g. EC cert with RSA expectations); copy-paste truncation when adding the PEM to a Docker volume.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The certificate key "${keyFile}" is invalid.\n${err.message}
• You specified ${type} in your env, but the file "${file}" ca
• The NODE_ENV environment variable is required but was not sp
• Your project's `baseUrl` can only be set to `src` or `node_m
• You have both a tsconfig.json and a jsconfig.json. If you ar

AI-assisted analysis of appsmithorg/appsmith@8cd9021c24 (2026-08-12). Data as JSON: /api/errors/4f5fd4b984f11369. Report an issue: GitHub.