openai/codex · error · anyhow::Error

startup CA bundle contained an invalid trusted certificate:

Error message

startup CA bundle contained an invalid trusted certificate: {}

What it means

Error "startup CA bundle contained an invalid trusted certificate: {}" thrown in openai/codex.

Source

Thrown at codex-rs/network-proxy/src/certs.rs:349

    let contains_trusted_certificates = pem.contains("TRUSTED CERTIFICATE");
    let normalized_pem = pem
        .replace("BEGIN TRUSTED CERTIFICATE", "BEGIN CERTIFICATE")
        .replace("END TRUSTED CERTIFICATE", "END CERTIFICATE");
    let certs = CertificateDer::pem_slice_iter(normalized_pem.as_bytes())
        .collect::<std::result::Result<Vec<_>, _>>()
        .with_context(|| format!("failed to parse startup CA bundle: {}", path.display()))?;
    if certs.is_empty() {
        return Err(anyhow!(
            "startup CA bundle contained no certificates: {}",
            path.display()
        ));
    }
    certs
        .into_iter()
        .map(|cert| {
            let cert = if contains_trusted_certificates {
                first_der_item(cert.as_ref()).ok_or_else(|| {
                    anyhow!(
                        "startup CA bundle contained an invalid trusted certificate: {}",
                        path.display()
                    )
                })?
            } else {
                cert.as_ref()
            };
            Ok(CertificateDer::from(cert.to_vec()))
        })
        .collect()
}

fn load_ca_directory_certificates(path: &Path) -> Vec<CertificateDer<'static>> {
    let rustls_native_certs::CertificateResult { certs, errors, .. } =
        rustls_native_certs::load_certs_from_paths(None, Some(path));
    if !errors.is_empty() {
        warn!(
            ca_path = %path.display(),

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/network-proxy/src/certs.rs:349 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/f32dc714436cf2bb. Report an issue: GitHub.