openai/codex · error · BuildCustomCaTransportError

Failed to load CA certificates from

Error message

Failed to load CA certificates from {} selected by {}: {detail}. {hint}

What it means

The CA file was read successfully but produced no usable certificate material, so the custom CA bundle could not be loaded. This InvalidCaFile variant of BuildCustomCaTransportError fires during PEM processing when the file exists and is readable yet contains no valid CERTIFICATE blocks or otherwise unusable material; the `detail` string describes the specific parse/loader failure and the hint points at the env var that selected the file.

Solutions

1. Ensure the file is PEM-encoded and contains one or more complete BEGIN CERTIFICATE...END CERTIFICATE blocks
2. Re-export the CA bundle from its source (e.g. re-download the corporate root CA) in PEM format rather than DER
3. Validate the file with `openssl x509 -in $CODEX_CA_CERTIFICATE -noout -text` to confirm it parses
4. Unset CODEX_CA_CERTIFICATE/SSL_CERT_FILE to use system roots if a custom CA is not required

When it happens

Trigger: Thrown at codex-rs/http-client/src/custom_ca.rs:89 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/16e20f7623ec4a04. Report an issue: GitHub.

Appendix: source

Thrown at codex-rs/http-client/src/custom_ca.rs:89

/// because the final reqwest client builder failed. Callers that do not care about the
/// distinction can rely on the `From<BuildCustomCaTransportError> for io::Error` conversion.
#[derive(Debug, Error)]
pub enum BuildCustomCaTransportError {
    /// Reading the selected CA file from disk failed before any PEM parsing could happen.
    #[error(
        "Failed to read CA certificate file {} selected by {}: {source}. {hint}",
        path.display(),
        source_env,
        hint = CA_CERT_HINT
    )]
    ReadCaFile {
        source_env: &'static str,
        path: PathBuf,
        source: io::Error,
    },

    /// The selected CA file was readable, but did not produce usable certificate material.
    #[error(
        "Failed to load CA certificates from {} selected by {}: {detail}. {hint}",
        path.display(),
        source_env,
        hint = CA_CERT_HINT
    )]
    InvalidCaFile {
        source_env: &'static str,
        path: PathBuf,
        detail: String,
    },

    /// One parsed certificate block could not be registered with the reqwest client builder.
    #[error(
        "Failed to parse certificate #{certificate_index} from {} selected by {}: {source}. {hint}",
        path.display(),
        source_env,
        hint = CA_CERT_HINT
    )]

View on GitHub (pinned to 339751715c)