hatoo/oha · error

Failed to parse cacert_pem

Error message

Failed to parse cacert_pem

What it means

NativeTlsConnectors::new parses the user-supplied cacert_pem bytes with native_tls::Certificate::from_pem and panics via expect() when the bytes are not valid PEM-encoded certificate data. The input at fault is the custom --cacert file: malformed PEM, DER-only, empty, or containing multiple/unexpected blocks.

Solutions

1. Confirm the file is PEM format, starting with '-----BEGIN CERTIFICATE-----'.
2. Re-export the certificate in PEM form (e.g. openssl x509 -inform der -in cert.der -out cert.pem).
3. Check the file is not empty or truncated and contains the full chain.
4. Validate the PEM with 'openssl x509 -in cert.pem -noout' before passing it.

When it happens

Trigger: Thrown at src/tls_config.rs:96 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of hatoo/oha@4efba2d113 (2026-09-09). Data as JSON: /api/errors/86546545fdbd617d. Report an issue: GitHub.

Appendix: source

Thrown at src/tls_config.rs:96

#[cfg(all(feature = "native-tls", not(feature = "rustls")))]
pub struct NativeTlsConnectors {
    pub no_alpn: tokio_native_tls::TlsConnector,
    pub alpn_h2: tokio_native_tls::TlsConnector,
}

#[cfg(all(feature = "native-tls", not(feature = "rustls")))]
impl NativeTlsConnectors {
    pub fn new(
        insecure: bool,
        cacert_pem: Option<&[u8]>,
        client_auth: Option<(&[u8], &[u8])>,
    ) -> Self {
        let new = |is_http2: bool| {
            let mut connector_builder = native_tls::TlsConnector::builder();

            if let Some(cacert_pem) = cacert_pem {
                let cert = native_tls::Certificate::from_pem(cacert_pem)
                    .expect("Failed to parse cacert_pem");
                connector_builder.add_root_certificate(cert);
            }

            if insecure {
                connector_builder
                    .danger_accept_invalid_certs(true)
                    .danger_accept_invalid_hostnames(true);
            }

            if let Some((cert, key)) = client_auth {
                let cert = native_tls::Identity::from_pkcs8(cert, key)
                    .expect("Failed to parse client_auth cert/key");
                connector_builder.identity(cert);
            }

            if is_http2 {
                connector_builder.request_alpns(&["h2"]);
            }

View on GitHub (pinned to 4efba2d113)