decolua/9router · error · Error

Failed to install certificate: ${e.message}

Error message

Failed to install certificate: ${e.message}

What it means

installCertWindows() runs a certutil script in an elevated PowerShell (UAC). If runElevatedPowerShell fails or certutil exits non-zero ($LASTEXITCODE -ne 0), the error is rethrown as `Failed to install certificate: <detail>`. It wraps any elevation or certutil failure.

Source

Thrown at src/mitm/cert/install.js:131

  } catch (error) {
    const msg = error.message?.includes("canceled") ? "User canceled authorization" : "Certificate install failed";
    throw new Error(msg);
  }
}

async function installCertWindows(certPath) {
  // Auto-elevate via UAC popup if not admin (zero popup if already admin).
  // Delete any stale cert with same CN before adding to avoid duplicates.
  const script = `
    certutil -delstore Root ${quotePs(ROOT_CA_CN)} 2>$null | Out-Null
    $exit = & certutil -addstore Root ${quotePs(certPath)} 2>&1
    if ($LASTEXITCODE -ne 0) { throw "certutil exit $LASTEXITCODE" }
  `;
  try {
    await runElevatedPowerShell(script);
    log("🔐 Cert: ✅ installed to Windows Root store");
  } catch (e) {
    throw new Error(`Failed to install certificate: ${e.message}`);
  }
}

/**
 * Uninstall SSL certificate from system store
 */
async function uninstallCert(sudoPassword, certPath) {
  const isInstalled = await checkCertInstalled(certPath);
  if (!isInstalled) {
    log("🔐 Cert: not found in system store");
    return;
  }

  if (IS_WIN) {
    await uninstallCertWindows();
  } else if (IS_MAC) {
    await uninstallCertMac(sudoPassword, certPath);
  } else {

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Accept the UAC elevation prompt when it appears
2. Run the dashboard/terminal once as Administrator so elevation is already in place
3. Manually run `certutil -addstore Root <cert>` in an admin PowerShell to see the raw certutil error
4. Check antivirus/EDR is not blocking certutil or elevated PowerShell

const isAdmin = (await exec('net session').catch(() => null)) !== null;
if (!isAdmin) console.warn('Elevation prompt (UAC) will appear for certificate install');

try {
  await installCert(sudoPassword, certPath);
} catch (e) {
  if (e.message.startsWith('Failed to install certificate:')) {
    console.error('certutil/UAC failed:', e.message);
    // instruct manual: certutil -addstore Root <cert> from an admin shell
  } else throw e;
}

When it happens

Trigger: installCert() on Windows when: the user declines the UAC elevation prompt, the process is not admin and elevation fails, certutil -addstore Root exits non-zero, or PowerShell execution policy blocks the spawned script.

Common situations: User clicks 'No' on UAC popup; running in a non-elevated service/CI context where UAC cannot appear; antivirus blocking certutil; Windows editions where Root store writes require different tooling.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Failed to uninstall certificate: ${e.message}
• Installation finished but tailscale.exe not found
• Certificate file not found: ${certPath}
• User canceled authorization | Certificate install failed
• Failed to uninstall certificate

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/7dd807f3b84685cd. Report an issue: GitHub.