diegosouzapw/OmniRoute · error · Error

Certificate install failed

Error message

Certificate install failed

What it means

Error "Certificate install failed" thrown in diegosouzapw/OmniRoute.

Source

Thrown at src/mitm/cert/install.ts:390

  try {
    const config = getLinuxCertConfig();
    const destFile = `${config.dir}/${LINUX_CERT_NAME}`;

    await execFileWithPassword("sudo", ["-S", "mkdir", "-p", config.dir], sudoPassword);
    await execFileWithPassword("sudo", ["-S", "cp", certPath, destFile], sudoPassword);
    // #9442: `cp` inherits the process umask. A restrictive umask (e.g. PM2
    // UMask=0077) creates the system cert as 0600 root:root, unreadable by
    // non-root TLS clients. Force the public cert to 0644 (world-readable).
    await execFileWithPassword("sudo", ["-S", "chmod", "0644", destFile], sudoPassword);
    await execFileWithPassword("sudo", ["-S", config.cmd], sudoPassword);

    await updateNssDatabases(certPath, "add");
  } catch (error) {
    const message = getErrorMessage(error);
    const msg = message.includes("canceled")
      ? "User canceled authorization"
      : "Certificate install failed";
    throw new Error(msg);
  }
}

/**
 * #9442 — ensure the system trust-store cert is world-readable (mode 0644).
 *
 * `installCertLinux()` now sets the mode explicitly after `cp`, but a cert
 * installed by an older build (before the chmod was added) may still be 0600
 * from a restrictive umask. `checkCertInstalledLinux()` only compares
 * fingerprints, so {@link installCert}'s already-installed branch calls this
 * helper to repair the mode on re-run. Best-effort: a stat/chmod failure
 * (e.g. dest removed between the fingerprint check and here) is swallowed —
 * the caller still reports "already installed" and a fresh install will run
 * next time the fingerprint no longer matches.
 */
export async function ensureSystemCertMode(destFile: string, sudoPassword: string): Promise<void> {
  try {
    const mode = fs.statSync(destFile).mode & 0o777;

View on GitHub (pinned to a179ffed5b)

When it happens

Trigger: Thrown at src/mitm/cert/install.ts:390 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/76e30b149c5f3e96. Report an issue: GitHub.