diegosouzapw/OmniRoute · error · Error

Failed to uninstall certificate

Error message

Failed to uninstall certificate

What it means

Catch-all from uninstallCertMac (and sibling Linux uninstall paths): the `security delete-certificate -Z <fingerprint>` (or Linux remove/update-ca-certificates) step threw, and the raw error is replaced with this sanitized sentinel. Means the MITM root CA may still be present in the trust store — the deletion did not complete; the underlying cause (wrong password, missing cert, keychain locked) is not exposed.

Solutions

1. Verify the sudo password supplied for uninstall
2. Check whether the cert is actually still listed (security find-certificate / trust store listing) and retry
3. If the cert was already removed, treat the state as clean and continue

When it happens

Trigger: Thrown at src/mitm/cert/install.ts:479 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/8652e22fcd5d7dc0. Report an issue: GitHub.

Appendix: source

Thrown at src/mitm/cert/install.ts:479

async function uninstallCertMac(sudoPassword: string, certPath: string): Promise<void> {
  const fingerprint = getCertFingerprint(certPath).replace(/:/g, "");
  try {
    await execFileWithPassword(
      "sudo",
      [
        "-S",
        "security",
        "delete-certificate",
        "-Z",
        fingerprint,
        "/Library/Keychains/System.keychain",
      ],
      sudoPassword
    );
    console.log("✅ Uninstalled certificate from system keychain");
  } catch (err) {
    throw new Error("Failed to uninstall certificate");
  }
}

async function uninstallCertLinux(sudoPassword: string, certPath: string): Promise<void> {
  try {
    await updateNssDatabases(null, "delete");

    const config = getLinuxCertConfig();
    const destFile = `${config.dir}/${LINUX_CERT_NAME}`;

    if (fs.existsSync(destFile)) {
      await execFileWithPassword("sudo", ["-S", "rm", "-f", destFile], sudoPassword);
    }

    try {
      await execFileWithPassword("sudo", ["-S", config.cmd, "--fresh"], sudoPassword);
    } catch {
      await execFileWithPassword("sudo", ["-S", config.cmd], sudoPassword);

View on GitHub (pinned to a179ffed5b)