diegosouzapw/OmniRoute · error · Error

User canceled authorization

Error message

User canceled authorization

What it means

Error translation in installCertMac's catch: the `security add-trusted-cert` command failed and the underlying message contains 'canceled', so the generic failure is narrowed to this user-facing sentinel. Means the macOS admin password prompt (sudo via the security tool) was dismissed/denied by the operator — the certificate was NOT installed, but nothing is wrong with the cert itself.

Solutions

1. Retry the install and approve the macOS authorization prompt with the correct admin credentials
2. Verify the sudo password supplied to the MITM flow is valid
3. If the prompt never appears, check sudoers/timeout settings on the host

When it happens

Trigger: Thrown at src/mitm/cert/install.ts:367 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of diegosouzapw/OmniRoute@a179ffed5b (2026-08-25). Data as JSON: /api/errors/a3a726f617cd7f60. Report an issue: GitHub.

Appendix: source

Thrown at src/mitm/cert/install.ts:367

        "-S",
        "security",
        "add-trusted-cert",
        "-d",
        "-r",
        "trustRoot",
        "-k",
        "/Library/Keychains/System.keychain",
        certPath,
      ],
      sudoPassword
    );
    console.log(`✅ Installed certificate to system keychain: ${certPath}`);
  } catch (error) {
    const message = getErrorMessage(error);
    const msg = message.includes("canceled")
      ? "User canceled authorization"
      : "Certificate install failed";
    throw new Error(msg);
  }
}

async function installCertLinux(sudoPassword: string, certPath: string): Promise<void> {
  try {
    const config = getLinuxCertConfig();
    const destFile = `${config.dir}/${LINUX_CERT_NAME}`;

    await execFileWithPassword("sudo", ["-S", "mkdir", "-p", config.dir], sudoPassword);
    await execFileWithPassword("sudo", ["-S", "cp", certPath, destFile], sudoPassword);
    // #9442: `cp` inherits the process umask. A restrictive umask (e.g. PM2
    // UMask=0077) creates the system cert as 0600 root:root, unreadable by
    // non-root TLS clients. Force the public cert to 0644 (world-readable).
    await execFileWithPassword("sudo", ["-S", "chmod", "0644", destFile], sudoPassword);
    await execFileWithPassword("sudo", ["-S", config.cmd], sudoPassword);

    await updateNssDatabases(certPath, "add");
  } catch (error) {

View on GitHub (pinned to a179ffed5b)