oven-sh/bun · critical

InvalidCAFile

Error message

InvalidCAFile

What it means

The CA file was found and read, but its content is not a usable certificate bundle (uws invalid_ca_file mapped at src/http/HTTPContext.rs:519; fatal message 'the CA file is invalid' at src/http/HTTPThread.rs:362-368). BoringSSL could not parse it as PEM CA material — wrong format, stray text, or a private key where a cert belongs.

Source

Thrown at src/http/InitError.rs:7

#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]
pub enum InitError {
    #[error("FailedToOpenSocket")]
    FailedToOpenSocket,
    #[error("LoadCAFile")]
    LoadCAFile,
    #[error("InvalidCAFile")]
    InvalidCAFile,
    #[error("InvalidCA")]
    InvalidCA,
    #[error("InvalidCRL")]
    InvalidCRL,
}

View on GitHub (pinned to 8c5296ac45)

Solutions

  1. Validate the bundle before use: `openssl x509 -in ca.pem -noout -subject` (or `openssl crl2pkcs7 -nocrl -certfile ca.pem | openssl pkcs7 -print_certs -noout` for multi-cert bundles).
  2. Convert DER to PEM if needed: `openssl x509 -inform der -in ca.cer -out ca.pem`.
  3. Rebuild the bundle ensuring each block is a complete `-----BEGIN CERTIFICATE-----`/`-----END CERTIFICATE-----` pair separated by newlines.
  4. Confirm the file contains certificates, not keys: `grep -c 'BEGIN CERTIFICATE' ca.pem` should be >= 1 and `grep 'PRIVATE KEY' ca.pem` empty.

Example fix

# before: DER file passed directly
[install]
cafile = "corp-ca.cer"   # binary DER -> InvalidCAFile
# after: convert to PEM first
openssl x509 -inform der -in corp-ca.cer -out corp-ca.pem
# bunfig.toml
[install]
cafile = "corp-ca.pem"
Defensive patterns

Strategy: validation

Validate before calling

import { execSync } from 'node:child_process';
// Multi-cert bundles: parse every PEM block
execSync(`openssl crl2pkcs7 -nocrl -certfile ca.pem | openssl pkcs7 -print_certs -noout`, { stdio: 'pipe' });
// throws if the file is not valid PEM CA material

Prevention

When it happens

Trigger: `cafile` points to a DER-encoded .cer (binary) instead of PEM, to a PEM containing a private key or CSR rather than CA certificates, to a file with smart-quote/copy-paste corruption of the BEGIN/END markers, or to an HTML error page saved as .pem.

Common situations: Exporting a cert from Windows certmgr as DER and using it directly; concatenating bundles with a missing newline so footer/header collide; files edited by rich-text editors inserting BOM/zero-width chars; artifact-proxy corrupted downloads.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/9cc5f4da8fcd3835. Report an issue: GitHub.