musistudio/claude-code-router · error · Error

${status.message}

Error message

${status.message}

What it means

Thrown by the proxy service when the MITM CA certificate is not trusted by the OS trust store. Before starting or attaching, the service checks certificate status and refuses to operate if the certificate has not been installed/trusted, since HTTPS interception would fail with TLS errors downstream.

Source

Thrown at packages/core/src/proxy/service.ts:626

          state: "untrusted",
          trusted: false
        };
      }
    }

    return {
      ...base,
      canInstall: false,
      message: "Automatic certificate trust detection is not supported on this platform. Import the CA certificate manually before enabling proxy mode.",
      state: "unsupported",
      trusted: false
    };
  }

  private async requireTrustedCertificate(): Promise<void> {
    const status = await this.getCertificateStatus();
    if (!status.trusted) {
      throw new Error(status.message);
    }
  }

  private async handleConnect(request: IncomingMessage, clientSocket: Socket, head: Buffer): Promise<void> {
    const target = parseConnectTarget(request.url);
    const mitmServer = await this.getMitmServer(target.hostname);
    const localSocket = net.connect(mitmServer.port, "127.0.0.1");
    localSocket.once("connect", () => {
      clientSocket.write("HTTP/1.1 200 Connection Established\r\nProxy-agent: CCR-MITM\r\n\r\n");
      if (head.length > 0) {
        localSocket.write(head);
      }
      localSocket.pipe(clientSocket);
      clientSocket.pipe(localSocket);
    });
    localSocket.once("error", (error) => {
      handleConnectError(request, clientSocket, error);
    });

View on GitHub (pinned to 99f24806c6)

Solutions

1. Install/trust the proxy CA certificate (use the library's certificate install API or add it to the OS trust store) and retry start()
2. Run getCertificateStatus() first and surface its message to guide installation
3. On Linux ensure nss tools (certutil) are installed so the trust check can succeed
4. If in CI/container, pre-bake the certificate into the image's trust store

Example fix

// before
await proxy.start(); // throws status.message

// after
const status = await proxy.getCertificateStatus();
if (!status.trusted) {
  await proxy.installCertificate(); // or follow status.message instructions
}
await proxy.start();

const status = await proxy.getCertificateStatus();
if (!status.trusted) {
  throw new Error(`Certificate not trusted: ${status.message}`);
}
await proxy.start();

try { await proxy.start(); } catch (e) { if (/trust|certificate/i.test(e.message)) await installAndRetry(); else throw e; }

When it happens

Trigger: Calling start() or attach() on the proxy service when the generated CA certificate was never installed into the system/OS trust store, or was installed but the store check (getCertificateStatus()) reports trusted=false (e.g. missing on Linux NSS store, or keychain trust settings changed).

Common situations: First run on Linux where certutil/NSS DB is absent; corporate policies resetting trust stores; deleted certificate; running in a container without the trust step; macOS user approved keychain but system-wide trust missing.

Related errors

• Failed to start MITM server for ${hostname}
• Proxy request is missing Host header.
• CONNECT target is missing.

AI-assisted analysis of musistudio/claude-code-router@99f24806c6 (2026-08-27). Data as JSON: /api/errors/1ecf1fad3eb0fdd4. Report an issue: GitHub.