openai/codex · error · anyhow::Error

startup CA bundle contained no certificates: {}

Error message

startup CA bundle contained no certificates: {}

What it means

Error "startup CA bundle contained no certificates: {}" thrown in openai/codex.

Source

Thrown at codex-rs/network-proxy/src/certs.rs:339

    }
    let mut seen = HashSet::new();
    certificates.retain(|cert| cert != &managed_ca_cert && seen.insert(cert.as_ref().to_vec()));
    Ok(certificates)
}

fn read_ca_certificates(path: &Path) -> Result<Vec<CertificateDer<'static>>> {
    let pem = fs::read(path)
        .with_context(|| format!("failed to read startup CA bundle: {}", path.display()))?;
    let pem = String::from_utf8_lossy(&pem);
    let contains_trusted_certificates = pem.contains("TRUSTED CERTIFICATE");
    let normalized_pem = pem
        .replace("BEGIN TRUSTED CERTIFICATE", "BEGIN CERTIFICATE")
        .replace("END TRUSTED CERTIFICATE", "END CERTIFICATE");
    let certs = CertificateDer::pem_slice_iter(normalized_pem.as_bytes())
        .collect::<std::result::Result<Vec<_>, _>>()
        .with_context(|| format!("failed to parse startup CA bundle: {}", path.display()))?;
    if certs.is_empty() {
        return Err(anyhow!(
            "startup CA bundle contained no certificates: {}",
            path.display()
        ));
    }
    certs
        .into_iter()
        .map(|cert| {
            let cert = if contains_trusted_certificates {
                first_der_item(cert.as_ref()).ok_or_else(|| {
                    anyhow!(
                        "startup CA bundle contained an invalid trusted certificate: {}",
                        path.display()
                    )
                })?
            } else {
                cert.as_ref()
            };
            Ok(CertificateDer::from(cert.to_vec()))

View on GitHub (pinned to 339751715c)

When it happens

Trigger: Thrown at codex-rs/network-proxy/src/certs.rs:339 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/081f6e65371882f2. Report an issue: GitHub.