facebook/docusaurus · error · Error

The certificate path=${cert.path} is invalid.

Error message

The certificate path=${cert.path} is invalid.

What it means

Thrown by `validateKeyAndCerts` when `new crypto.X509Certificate(cert.content)` fails to parse the provided certificate. The original parse error is preserved as `cause`. This guards the HTTPS dev server before it tries to use an unreadable cert.

Source

Thrown at packages/docusaurus/src/webpack/utils/getHttpsConfig.ts:24

 */

import fs from 'fs-extra';
import path from 'path';
import crypto from 'crypto';
import logger from '@docusaurus/logger';

// Ensure the certificate and key provided are valid and if not
// throw an easy to debug error.
//
// Works for any key type (RSA, ECDSA, EdDSA, ...) — parses both PEMs and
// checks that the public key embedded in the cert matches the public key
// derived from the private key.
function validateKeyAndCerts({cert, key}: {cert: CryptoFile; key: CryptoFile}) {
  let certPublicKey: crypto.KeyObject;
  try {
    certPublicKey = new crypto.X509Certificate(cert.content).publicKey;
  } catch (error) {
    throw new Error(
      logger.interpolate`The certificate path=${cert.path} is invalid.`,
      {cause: error},
    );
  }

  let keyPublicKey: crypto.KeyObject;
  try {
    keyPublicKey = crypto.createPublicKey(crypto.createPrivateKey(key.content));
  } catch (error) {
    throw new Error(
      logger.interpolate`The certificate key path=${key.path} is invalid.`,
      {cause: error},
    );
  }

  if (!certPublicKey.equals(keyPublicKey)) {
    throw new Error(
      logger.interpolate`The certificate path=${cert.path} and key path=${key.path} do not match.`,

View on GitHub (pinned to 3f483e80e3)

Solutions

1. Verify the file is a PEM certificate: `openssl x509 -in cert.pem -noout`.
2. Ensure `sslCert` and `sslKey` are not swapped.
3. Regenerate the cert/key pair (e.g. `mkcert localhost` or the Docusaurus HTTPS docs recipe).
4. Use an absolute path to the cert file.

Example fix

# before
docusaurus start --https --ssl-cert ./key.pem --ssl-key ./cert.pem
# after (swapped correctly)
docusaurus start --https --ssl-cert ./cert.pem --ssl-key ./key.pem

const crypto = require('crypto');
const fs = require('fs');
function isValidCert(path: string) {
  try { new crypto.X509Certificate(fs.readFileSync(path)); return true; } catch { return false; }
}

try {
  validateKeyAndCerts({cert, key});
} catch (e) {
  if (/certificate path=.* is invalid/.test(e.message)) {
    console.error('SSL cert unreadable — regenerate with mkcert');
  }
  throw e;
}

When it happens

Trigger: Passing `--ssl-cert` (or `sslCert` in config) pointing to a file that is not a valid PEM/X.509 certificate. The try/catch at getHttpsConfig.ts:21-28 wraps the X509 construction failure.

Common situations: Pointing `sslCert` at the private key file by mistake; a cert generated with the wrong format (DER instead of PEM); a truncated/corrupted cert; copy-paste errors dropping the BEGIN/END CERTIFICATE lines.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The certificate key path=${key.path} is invalid.
• The certificate path=${cert.path} and key path=${key.path} d
• You specified ${source}, but file at path path=${filepath} c
• HTTPS support require proving a certificate and key at the s
• You specified ${source}, but file at path path=${filepath} c

AI-assisted analysis of facebook/docusaurus@3f483e80e3 (2026-08-12). Data as JSON: /api/errors/f2b9e03e2df04781. Report an issue: GitHub.