This binary was built without native-tls support

Error message

This binary was built without native-tls support

What it means

The user passed the --native-tls flag, but the binary was compiled without the `native-tls` cargo feature, so there is no native TLS backend to switch to. The CLI rejects the flag at runtime rather than silently ignoring it.

Solutions

Remove the --native-tls flag and use the default TLS backend (rustls).
Install/rebuild a binary with the native-tls feature: cargo build --features native-tls.
Set required system TLS dependencies (e.g. OpenSSL dev packages) when rebuilding with native-tls.
Download the official full-featured release binary instead of a minimal build.

Example fix

// before
xh --native-tls GET example.org
// after
cargo install xh --features native-tls
xh --native-tls GET example.org  # or omit the flag

Defensive patterns

Strategy: fallback

Validate before calling

// shell guard before invoking
if [ -n "$NATIVE_TLS_FLAG" ] && ! xh --version >/dev/null 2>&1; then :; fi
// or in code: skip the flag unless the build advertises native-tls
let use_native = args.native_tls && cfg!(feature = "native-tls");

Try / catch

match run(args) {
    Err(e) if e.to_string().contains("without native-tls") => {
        args.native_tls = false; // retry with default TLS backend
        run(args)
    }
    other => other,
}

Prevention

Only pass --native-tls on builds you know include the feature.
Document the feature set of the binary your team distributes.
Prefer the default rustls backend unless corporate TLS interception requires native certs.
Check `--version`/build metadata for enabled features before scripting flags.

When it happens

Trigger: run() sees args.native_tls == true while the crate was built with #[cfg(not(feature = "native-tls"))].

Common situations: Using a distro-packaged or prebuilt binary compiled only with rustls and passing --native-tls; container images with slim builds; organizational mirror binaries built with default features only.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of ducaale/xh@2404aceecc (2026-09-13). Data as JSON: /api/errors/66942b892b299ebc. Report an issue: GitHub.

Appendix: source

Thrown at src/main.rs:188

            client = client.use_native_tls();
        }

        #[cfg(not(feature = "native-tls"))]
        if tls_version < tls::Version::TLS_1_2 {
            log::warn!(
                "rustls does not support older TLS versions. Consider building with the `native-tls` feature enabled."
            );
        }
    }

    #[cfg(feature = "native-tls")]
    if args.native_tls {
        client = client.use_native_tls();
    }

    #[cfg(not(feature = "native-tls"))]
    if args.native_tls {
        return Err(anyhow!("This binary was built without native-tls support"));
    }

    let mut failure_code = None;
    let mut resume: Option<u64> = None;
    let mut auth = None;
    let mut save_auth_in_session = true;

    let verify = args.verify.unwrap_or_else(|| {
        // requests library which is used by HTTPie checks for both
        // REQUESTS_CA_BUNDLE and CURL_CA_BUNDLE environment variables.
        // See https://docs.python-requests.org/en/master/user/advanced/#ssl-cert-verification
        if let Some(path) = env::var_os("REQUESTS_CA_BUNDLE") {
            Verify::CustomCaBundle(PathBuf::from(path))
        } else if let Some(path) = env::var_os("CURL_CA_BUNDLE") {
            Verify::CustomCaBundle(PathBuf::from(path))
        } else {
            Verify::Yes
        }

View on GitHub (pinned to 2404aceecc)