denoland/deno · error

not yet implemented

Error message

not yet implemented

What it means

create_client_config supports three TLS key sources: static PEM material (TlsKeys::Static), no client cert (TlsKeys::Null), and a per-connection resolver (TlsKeys::Resolver). In the branch taken when unsafely_ignore_certificate_errors is active, the resolver variant is an unimplemented!() stub, so combining certificate-error ignore lists with a TLS key resolver panics.

Source

Thrown at ext/tls/lib.rs:321

    cert_chain_and_key: maybe_cert_chain_and_key,
    socket_use,
  } = options;
  if let Some(ic_allowlist) = unsafely_ignore_certificate_errors {
    let client_config = ClientConfig::builder()
      .dangerous()
      .with_custom_certificate_verifier(Arc::new(
        NoCertificateVerification::new(ic_allowlist),
      ));

    // NOTE(bartlomieju): this if/else is duplicated at the end of the body of this function.
    // However it's not really feasible to deduplicate it as the `client_config` instances
    // are not type-compatible - one wants "client cert", the other wants "transparency policy
    // or client cert".
    let mut client = match maybe_cert_chain_and_key {
      TlsKeys::Static(TlsKey(cert_chain, private_key)) => client_config
        .with_client_auth_cert(cert_chain, private_key.clone_key())?,
      TlsKeys::Null => client_config.with_no_client_auth(),
      TlsKeys::Resolver(_) => unimplemented!(),
    };

    client.key_log = get_ssl_key_log();
    add_alpn(&mut client, socket_use);
    return Ok(client);
  }

  let mut root_cert_store =
    root_cert_store.unwrap_or_else(create_default_root_cert_store);
  // If custom certs are specified, add them to the store
  for cert in ca_certs {
    let reader = &mut BufReader::new(Cursor::new(cert));
    // This function does not return specific errors, if it fails give a generic message.
    for r in rustls_pemfile::certs(reader) {
      match r {
        Ok(cert) => {
          root_cert_store.add(cert)?;
        }

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Remove unsafely_ignore_certificate_errors when using a key resolver
2. Switch to TlsKeys::Static with a PEM cert chain and key
3. Track upstream support for the resolver + ignore-errors combination before enabling both

Example fix

// before
let opts = TlsClientConfigOptions {
  unsafely_ignore_certificate_errors: Some(vec!["bad.host".into()]),
  cert_chain_and_key: TlsKeys::Resolver(resolver),
  ..Default::default()
};

// after
let opts = TlsClientConfigOptions {
  unsafely_ignore_certificate_errors: None,
  cert_chain_and_key: TlsKeys::Static(TlsKey(cert_pem, key_pem)),
  ..Default::default()
};

fn config_supported(opts: &TlsClientConfigOptions) -> bool {
  let resolver_used = matches!(opts.cert_chain_and_key, TlsKeys::Resolver(_));
  let ignores_cert_errors = opts.unsafely_ignore_certificate_errors.is_some();
  !(resolver_used && ignores_cert_errors)
}

match (&opts.cert_chain_and_key, opts.unsafely_ignore_certificate_errors.is_some()) {
  (TlsKeys::Resolver(_), true) => /* unsupported combination: reject early */,
  _ => create_client_config(opts)?,
}

When it happens

Trigger: Setting TlsClientConfigOptions with unsafely_ignore_certificate_errors = Some(...) and cert_chain_and_key = TlsKeys::Resolver(...), then calling create_client_config.

Common situations: Dynamic client-certificate provisioning (per-tenant certs via resolver) misconfigured together with the debug flag that ignores certificate errors.

Related errors

• Unsupported 'certFile' / 'keyFile' options provided: use 'ce
• Unsupported 'alpnProtocols' option provided. 'h2' and 'http/
• Both 'cert' and 'key' must be provided to enable HTTPS
• Socket is not a TCP socket - only TCP connections can be upg
• Unsupported transport: '${transport}'

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/676586eede44ae97. Report an issue: GitHub.