hatoo/oha · error

Failed to build native_tls::TlsConnector

Error message

Failed to build native_tls::TlsConnector

What it means

Final step of NativeTlsConnectors::new: connector_builder.build() is unwrapped with expect() and this message when the TLS connector cannot be constructed after all settings were applied — for example an invalid ALPN configuration, contradictory builder options, or an identity/certificate already rejected at a deeper stage. It indicates builder-level failure, not a network or remote-certificate problem.

Solutions

1. Check the combined builder options (cacert, identity, ALPN 'h2', danger-accept flags) for contradictions; simplify by disabling options one at a time.
2. Update or verify the native_tls / openssl backend version for known build() panics.
3. Test with a minimal builder (no cacert, no client auth) to isolate which added option breaks construction.
4. Capture the underlying error that expect() discards by replacing expect with proper error propagation.

When it happens

Trigger: Thrown at src/tls_config.rs:118 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hatoo/oha@4efba2d113 (2026-09-09). Data as JSON: /api/errors/53542b775f663603. Report an issue: GitHub.

Appendix: source

Thrown at src/tls_config.rs:118

            if insecure {
                connector_builder
                    .danger_accept_invalid_certs(true)
                    .danger_accept_invalid_hostnames(true);
            }

            if let Some((cert, key)) = client_auth {
                let cert = native_tls::Identity::from_pkcs8(cert, key)
                    .expect("Failed to parse client_auth cert/key");
                connector_builder.identity(cert);
            }

            if is_http2 {
                connector_builder.request_alpns(&["h2"]);
            }

            connector_builder
                .build()
                .expect("Failed to build native_tls::TlsConnector")
                .into()
        };

        Self {
            no_alpn: new(false),
            alpn_h2: new(true),
        }
    }

    pub fn connector(&self, is_http2: bool) -> &tokio_native_tls::TlsConnector {
        if is_http2 {
            &self.alpn_h2
        } else {
            &self.no_alpn
        }
    }
}

View on GitHub (pinned to 4efba2d113)