What causes "openssl failed: ${stderr}" in oven-sh/bun?

Check availability and version: `which openssl && openssl version`; install if missing (brew install openssl / apt-get install openssl)

oven-sh/bun · error · Error

openssl failed: ${stderr}

Error message

openssl failed: ${stderr}

What it means

The http3-hello benchmark generates a self-signed localhost certificate by spawning `openssl req` (365 days, /CN=localhost, writing key and cert to temp paths). If the openssl process exits non-zero, the script throws with openssl's captured stderr appended. The real cause is in that stderr: openssl is missing, not on PATH, or rejected the arguments/output paths.

Source

Thrown at bench/snippets/http3-hello.js:36

    [
      "req",
      "-x509",
      "-nodes",
      "-newkey",
      "rsa:2048",
      "-days",
      "365",
      "-subj",
      "/CN=localhost",
      "-keyout",
      keyPath,
      "-out",
      certPath,
    ],
    { stdio: ["ignore", "ignore", "pipe"] },
  );
  if (status !== 0) {
    throw new Error("openssl failed: " + stderr);
  }
  cert = readFileSync(certPath, "utf8");
  key = readFileSync(keyPath, "utf8");
}

const TOTAL = 10_000_000;
var i = 0;

const server = Bun.serve({
  port: 3001,
  http3: true,
  http1: true,
  tls: { cert, key, rejectUnauthorized: false },
  routes: { "/hi": new Response("hello!") },
  fetch(req) {
    if (i++ === TOTAL - 1) setTimeout(() => server.stop().then(() => process.exit(0)));
    return new Response("Hello, World!" + i);
  },

View on GitHub (pinned to 8c5296ac45)

Solutions

Check availability and version: `which openssl && openssl version`; install if missing (brew install openssl / apt-get install openssl)
Copy the exact `openssl req` invocation from bench/snippets/http3-hello.js and run it manually to see the full error
Make sure the keyPath/certPath directories are writable and stale files are removed
Re-run the benchmark once the manual command succeeds

Example fix

# before: openssl not installed -> 'openssl failed: ...not found'
# after
brew install openssl   # macOS
sudo apt-get install -y openssl   # Debian/Ubuntu

Defensive patterns

Strategy: validation

Validate before calling

const openssl = Bun.which('openssl') ?? process.env.OPENSSL_BIN;
if (!openssl) throw new Error('openssl is required to generate the benchmark certificate');

Try / catch

try {
  generateCert();
} catch (e) {
  if (String(e.message).startsWith('openssl failed:')) {
    console.error('Run the openssl req command manually to see the failure; check PATH and output paths');
  }
  throw e;
}

Prevention

Check for external tool dependencies with Bun.which/which before spawning them, and name the missing binary in the error
Include the spawned command in failure messages so users can reproduce the openssl error verbatim
Cache generated certs keyed by validity period instead of regenerating on every run

When it happens

Trigger: Spawning openssl for `openssl req -x509 -newkey ...` when the binary is absent, the -keyout/-out directory is unwritable, or an OpenSSL config/version incompatibility makes req fail. stdio is set so stderr is piped and included in the message.

Common situations: Minimal CI containers or slim Docker images without openssl; PATH differences when Bun spawns the child; leftover read-only cert/key files at the target paths; OpenSSL 3.x config parsing issues.

Related errors

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/8d32cac71419ba17. Report an issue: GitHub.