hatoo/oha · error

could not load platform certs

Error message

could not load platform certs

What it means

RuslsConfigs::new calls load_native_certs() and unwraps with this panic message when the rustls-native-certs crate cannot load the platform's certificate store (unreadable /etc/ssl/certs on Linux, missing Keychain access on macOS, or a corrupted store). Since it is an expect(), it aborts configuration at startup rather than returning an error.

Solutions

1. Ensure the platform CA bundle exists and is readable (e.g. /etc/ssl/certs/ca-certificates.crt on Debian/Ubuntu; install ca-certificates if missing).
2. On macOS, verify keychain access permissions for the process.
3. Supply a CA bundle explicitly via the cacert_pem option to bypass native cert loading.
4. Debug the underlying load_native_certs() error, which expect() discards.

When it happens

Trigger: Thrown at src/tls_config.rs:19 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hatoo/oha@4efba2d113 (2026-09-09). Data as JSON: /api/errors/b37432b59e893e59. Report an issue: GitHub.

Appendix: source

Thrown at src/tls_config.rs:19

#[cfg(feature = "rustls")]
pub struct RuslsConfigs {
    no_alpn: std::sync::Arc<rustls::ClientConfig>,
    alpn_h2: std::sync::Arc<rustls::ClientConfig>,
    alpn_h3: std::sync::Arc<rustls::ClientConfig>,
}

#[cfg(feature = "rustls")]
impl RuslsConfigs {
    pub fn new(
        insecure: bool,
        cacert_pem: Option<&[u8]>,
        client_auth: Option<(&[u8], &[u8])>,
    ) -> Self {
        use rustls_pki_types::pem::PemObject;
        use std::sync::Arc;

        let mut root_cert_store = rustls::RootCertStore::empty();
        for cert in rustls_native_certs::load_native_certs().expect("could not load platform certs")
        {
            root_cert_store.add(cert).unwrap();
        }

        if let Some(cacert_pem) = cacert_pem {
            for der in rustls_pki_types::CertificateDer::pem_slice_iter(cacert_pem) {
                root_cert_store.add(der.unwrap()).unwrap();
            }
        }

        let _ = rustls::crypto::CryptoProvider::install_default(
            rustls::crypto::aws_lc_rs::default_provider(),
        );
        let builder = rustls::ClientConfig::builder().with_root_certificates(root_cert_store);

        let mut config = if let Some((cert, key)) = client_auth {
            let certs = rustls_pki_types::CertificateDer::pem_slice_iter(cert)
                .collect::<Result<Vec<_>, _>>()

View on GitHub (pinned to 4efba2d113)