What causes "CERT_SIGNATURE_FAILURE" in oven-sh/bun?

Re-issue and redeploy a fresh certificate+chain from the CA and retest

oven-sh/bun · error · CertError

CERT_SIGNATURE_FAILURE

Error message

CERT_SIGNATURE_FAILURE

What it means

X509 verify result 7 (X509_V_ERR_CERT_SIGNATURE_FAILURE): the certificate's signature is present and decryptable but invalid — the computed digest does not match, meaning the cert was altered or not signed by the claimed issuer. Mapped via get_cert_error_from_no (src/http/lib.rs:1526) to CertError::CERT_SIGNATURE_FAILURE, message "certificate signature failure" (FetchTasklet.rs:1391).

Source

Thrown at src/http/error.rs:135

    Picohttp(bun_picohttp::ParseResponseError),
}

#[allow(non_camel_case_types)]
#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]
pub enum CertError {
    #[error("OK")]
    OK,
    #[error("UNABLE_TO_GET_ISSUER_CERT")]
    UNABLE_TO_GET_ISSUER_CERT,
    #[error("UNABLE_TO_GET_CRL")]
    UNABLE_TO_GET_CRL,
    #[error("UNABLE_TO_DECRYPT_CERT_SIGNATURE")]
    UNABLE_TO_DECRYPT_CERT_SIGNATURE,
    #[error("UNABLE_TO_DECRYPT_CRL_SIGNATURE")]
    UNABLE_TO_DECRYPT_CRL_SIGNATURE,
    #[error("UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY")]
    UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY,
    #[error("CERT_SIGNATURE_FAILURE")]
    CERT_SIGNATURE_FAILURE,
    #[error("CRL_SIGNATURE_FAILURE")]
    CRL_SIGNATURE_FAILURE,
    #[error("CERT_NOT_YET_VALID")]
    CERT_NOT_YET_VALID,
    #[error("CERT_HAS_EXPIRED")]
    CERT_HAS_EXPIRED,
    #[error("CRL_NOT_YET_VALID")]
    CRL_NOT_YET_VALID,
    #[error("CRL_HAS_EXPIRED")]
    CRL_HAS_EXPIRED,
    #[error("ERROR_IN_CERT_NOT_BEFORE_FIELD")]
    ERROR_IN_CERT_NOT_BEFORE_FIELD,
    #[error("ERROR_IN_CERT_NOT_AFTER_FIELD")]
    ERROR_IN_CERT_NOT_AFTER_FIELD,
    #[error("ERROR_IN_CRL_LAST_UPDATE_FIELD")]
    ERROR_IN_CRL_LAST_UPDATE_FIELD,
    #[error("ERROR_IN_CRL_NEXT_UPDATE_FIELD")]

View on GitHub (pinned to 8c5296ac45)

Solutions

Re-issue and redeploy a fresh certificate+chain from the CA and retest
Verify the exact pair locally: openssl verify -CAfile <(cat intermediate.pem root.pem) leaf.pem
Compare served bytes with the file on disk (openssl s_client -showcerts) to catch deployment corruption
Investigate possible interception if the failure appears only on one network path

Defensive patterns

Strategy: try-catch

Type guard

function isCertErrorCode(e: unknown, code = "CERT_SIGNATURE_FAILURE"): e is Error & { code: string } {
  return e instanceof Error && (e as any).code === code;
}

Try / catch

try {
  await fetch(url);
} catch (e) {
  if (isCertErrorCode(e, "CERT_SIGNATURE_FAILURE")) {
    // cryptographic mismatch or tampering — do NOT bypass; alert security/ops
    throw new Error("Peer certificate failed signature verification");
  }
  throw e;
}

Prevention

Redeploy certs atomically (leaf + intermediate from the same issuance) after rotation
Treat sudden CERT_SIGNATURE_FAILURE on previously-working hosts as a possible MITM and investigate
Verify chains in deployment pipelines: openssl verify -CAfile chain.pem leaf.pem

When it happens

Trigger: TLS handshake where the leaf or an intermediate fails cryptographic signature verification — tampered cert bytes, a forged cert, or an issuer/leaf mismatch that still parses.

Common situations: A certificate regenerated with the same subject but not re-signed by the CA while the old intermediate is served, MITM tampering, corrupted cert files after deployment, or exotic signature algorithms the verifier computes differently.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/ebf41fb654b6ed55. Report an issue: GitHub.