denoland/deno · error · anyhow::Error

No certificate chain returned

Error message

No certificate chain returned

What it means

During provenance signing Deno requests a short-lived signing certificate from Fulcio (Sigstore's CA) and expects the response to carry either an embedded or detached signed-certificate-timestamp chain. When both fields are absent, there is no usable certificate chain and this error is thrown. It means Fulcio answered with a payload Deno could not use — outage, API change, or a mangled response.

Source

Thrown at cli/tools/publish/provenance.rs:531

          content: public_key,
        },
        proof_of_possession: BASE64_STANDARD.encode(challenge.as_ref()),
      },
    };

    let response = self
      .http_client
      .post_json(url.parse()?, &request_body)?
      .send()
      .await?;

    let body: SigningCertificateResponse =
      http_util::body_to_json(response).await?;

    let key = body
      .signed_certificate_embedded_sct
      .or(body.signed_certificate_detached_sct)
      .ok_or_else(|| anyhow::anyhow!("No certificate chain returned"))?;
    Ok(key.chain.certificates)
  }

  async fn gha_request_token(&self, aud: &str) -> Result<String, AnyError> {
    let Ok(req_url) = env::var("ACTIONS_ID_TOKEN_REQUEST_URL") else {
      bail!("Not running in GitHub Actions");
    };

    let Some(token) = gha_oidc_token() else {
      bail!("No OIDC token available");
    };

    let mut url = req_url.parse::<Url>()?;
    url.query_pairs_mut().append_pair("audience", aud);
    let res_bytes = self
      .http_client
      .get(url)?
      .header(

View on GitHub (pinned to 89f33cbef2)

Solutions

1. Retry the publish after a short wait — Fulcio hiccups are usually transient
2. Update Deno to the latest patch release
3. Verify https://fulcio.sigstore.dev is reachable and not intercepted by a proxy
4. Report it with debug logs if it persists

# preflight: is Fulcio reachable from this runner?
curl -fsS https://fulcio.sigstore.dev/ > /dev/null \
  || { echo "fulcio.sigstore.dev unreachable" >&2; exit 1; }

Same bounded-retry pattern as Rekor: retry `deno publish --provenance` with backoff (2-3 attempts), bumping the version if a partial upload consumed it; escalate to an issue only if it persists on the latest Deno.

When it happens

Trigger: `deno publish --provenance` where fulcio.sigstore.dev returns an error page or a changed response shape that deserializes with both SCT fields empty.

Common situations: Fulcio incidents or deployments; an old Deno version against a changed Fulcio API; proxies returning HTML error pages instead of JSON.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Rekor transparency log returned no entries
• GITHUB_REPOSITORY environment variable is not set
• GITHUB_SERVER_URL environment variable is not set
• GITHUB_REF environment variable is not set
• GITHUB_SHA environment variable is not set

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/9e340d2a3e4aeeb2. Report an issue: GitHub.