decolua/9router · error · Error

Certificate install failed: ${error.message}

Error message

Certificate install failed: ${error.message}

What it means

installCertLinux() copies the CA into the distro trust directory and updates NSS browser databases (updateNssDatabases 'add') via sudo. Any failure of execWithPassword or the NSS update is rethrown as `Certificate install failed: <detail>`.

Source

Thrown at src/mitm/cert/install.js:245

  if (!isSudoAvailable()) {
    log(`🔐 Cert: cannot install to system store without sudo — trust this file on clients: ${certPath}`);
    // Still try to update user NSS DBs even if no sudo!
    await updateNssDatabases(certPath, 'add');
    return;
  }
  
  const config = getLinuxCertConfig();
  const destFile = `${config.dir}/9router-root-ca.crt`;
  
  // Copy to the discovered directory and execute the specific update command
  const cmd = `cp "${certPath}" "${destFile}" && (${config.cmd} 2>/dev/null || true)`;
  
  try {
    await execWithPassword(cmd, sudoPassword);
    await updateNssDatabases(certPath, 'add');
    log(`🔐 Cert: ✅ installed to Linux trust store (${config.dir}) and user browser databases`);
  } catch (error) {
    throw new Error(`Certificate install failed: ${error.message}`);
  }
}

async function uninstallCertLinux(sudoPassword) {
  // Always try to uninstall from user DBs even without sudo
  await updateNssDatabases(null, 'delete');

  if (!isSudoAvailable()) {
    return;
  }
  
  const config = getLinuxCertConfig();
  const destFile = `${config.dir}/9router-root-ca.crt`;
  const cmd = `rm -f "${destFile}" && (${config.cmd} 2>/dev/null || true)`;
  
  try {
    await execWithPassword(cmd, sudoPassword);
    log("🔐 Cert: ✅ uninstalled from Linux trust store and user browser databases");

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Install NSS tools (`apt install libnss3-tools` / `dnf install nss-tools`) so browser DB updates can run
2. Close Firefox/Chrome before installing so the NSS databases are not locked
3. Verify the sudo password is correct (`sudo -v`)
4. Manually copy the CA to the distro trust dir and run update-ca-certificates to see the raw error
5. Check getLinuxCertConfig() detected the right distro family

// Ensure prerequisites before install
await exec('command -v certutil || echo NSS_TOOLS_MISSING');
if (!fs.existsSync(certPath)) throw new Error('cert file missing before Linux install');

try {
  await installCert(sudoPassword, certPath);
} catch (e) {
  if (e.message.startsWith('Certificate install failed:')) {
    console.error('Linux trust install failed:', e.message);
    // suggest: install libnss3-tools, close browsers, retry
  } else throw e;
}

When it happens

Trigger: installCert() on Linux when: the sudo password is wrong, the trust command for the distro (update-ca-certificates / update-ca-trust) fails, the target trust dir doesn't match the detected distro config, or certutil (NSS) is missing/unable to open the browser profile databases.

Common situations: Unsupported/minimal distro where getLinuxCertConfig() guessed the wrong dir; Firefox/NSS DB locked while the browser is running; certutil not installed (libnss3-tools missing); sudo requiring TTY in headless sessions.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Invalid sudo password
• User canceled authorization | Certificate install failed
• Sudo password required to install Root CA certificate
• Failed to trust certificate: ${e.message}
• Sudo password required to trust certificate

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/62a75d588aea73e9. Report an issue: GitHub.