oven-sh/bun · critical · InitError

LoadCAFile

Error message

LoadCAFile

What it means

The configured CA bundle file could not be loaded (uws create_bun_socket_error_t::load_ca_file mapped at src/http/HTTPContext.rs:518). The HTTP-thread init handler distinguishes 'failed to find CA file' (path doesn't exist) from 'failed to load CA file' (exists but unreadable) before crashing the process (src/http/HTTPThread.rs:338-361, 379). The path comes from `cafile` in npm/bun config (`BUN_CONFIG_CAFILE`, .npmrc/bunfig.toml cafile) or equivalent fetch/Bun.install TLS settings.

Source

Thrown at src/http/InitError.rs:5

#[derive(Debug, Clone, Copy, PartialEq, Eq, thiserror::Error, strum::IntoStaticStr)]
pub enum InitError {
    #[error("FailedToOpenSocket")]
    FailedToOpenSocket,
    #[error("LoadCAFile")]
    LoadCAFile,
    #[error("InvalidCAFile")]
    InvalidCAFile,
    #[error("InvalidCA")]
    InvalidCA,
    #[error("InvalidCRL")]
    InvalidCRL,
}

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Check the exact path from the error message with `ls -l <path>` on the machine that crashed — fix the bunfig/npmrc/BUN_CONFIG_CAFILE value to an existing absolute path.
2. Ensure the process user has read permission on the CA file (common failure: root-owned 600 file read by non-root container user).
3. In containers, verify the CA file is actually baked into the image at the configured path (docker run --rm image ls -l /path).
4. If ~/.npmrc carries a stale cafile from another machine, override with BUN_CONFIG_CAFILE pointing to the right bundle.

Example fix

# before (bunfig.toml)
[install]
cafile = "~/certs/internal-ca.pem"   # '~' not expanded / file missing
# after
[install]
cafile = "/etc/ssl/corp/internal-ca.pem"  # absolute, readable path

import { existsSync, accessSync, constants } from 'node:fs';
const cafile = process.env.BUN_CONFIG_CAFILE ?? parseBunfigCafile();
if (cafile && !existsSync(cafile)) throw new Error(`CA file not found: ${cafile}`);
if (cafile) accessSync(cafile, constants.R_OK); // throws if unreadable
await fetch('https://example.com'); // safe now

When it happens

Trigger: First HTTPS request or `bun install` with `cafile = /path/ca.pem` (bunfig.toml), BUN_CONFIG_CAFILE, or npm config cafile pointing to a nonexistent path, a file with wrong permissions, or an unreadable mount (empty Docker volume, k8s secret not yet mounted).

Common situations: Corporate-proxy setups where the internal CA path is hardcoded per-platform and differs in CI; Docker images where the CA file is COPYied to a different path than bunfig.toml states; typos or `~` expansion that config parsing does not perform; Kubernetes secrets mounted after process start.

Related errors

• InvalidCAFile
• FailedToOpenSocket
• InvalidCA
• InvalidCRL
• page-cache eviction failed for ${path}; results would be war

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/7414988d3bd03234. Report an issue: GitHub.