What causes "Certificate and/or key not found" in parcel-bundler/parcel?

Verify both cert and key files exist and are readable: `ls -l `.

parcel-bundler/parcel · error · Error

Certificate and/or key not found

Error message

Certificate and/or key not found

What it means

Thrown by getCertificate when reading either options.cert or options.key via fs.readFile fails. Used by Parcel's dev server to obtain HTTPS material; any read error (missing file, permission denied, ENOENT) is collapsed into a single generic message, hiding which file failed.

Source

Thrown at packages/core/utils/src/getCertificate.js:15

// @flow
import type {HTTPSOptions} from '@parcel/types';
import type {FileSystem} from '@parcel/fs';

export default async function getCertificate(
  fs: FileSystem,
  options: HTTPSOptions,
): Promise<{|cert: Buffer, key: Buffer|}> {
  try {
    let cert = await fs.readFile(options.cert);
    let key = await fs.readFile(options.key);

    return {key, cert};
  } catch (err) {
    throw new Error('Certificate and/or key not found');
  }
}

View on GitHub (pinned to 59484858a1)

Solutions

Verify both cert and key files exist and are readable: `ls -l <cert> <key>`.
Use absolute paths for --cert and --key to avoid cwd resolution issues.
Regenerate a self-signed cert if the files are missing (`mkcert` or `openssl req -x509 ...`).
Check file permissions/ownership so the Parcel process can read them.

Example fix

// before
getCertificate(fs, { cert: 'cert.pem', key: 'key.pem' }); // ENOENT

// after
getCertificate(fs, {
  cert: path.resolve('certs/cert.pem'),
  key:  path.resolve('certs/key.pem'),
});

Defensive patterns

Strategy: validation

Validate before calling

import fs from 'fs';
function assertCertFiles(opts) {
  for (const k of ['cert','key']) {
    if (!opts[k] || !fs.existsSync(opts[k])) {
      throw new Error(`HTTPS ${k} file missing: ${opts[k] ?? '(unset)'}`);
    }
  }
}
assertCertFiles(httpsOptions);

Type guard

interface HTTPSOptions { cert: string; key: string; }
function hasValidCertPaths(o: Partial<HTTPSOptions>): o is HTTPSOptions {
  return typeof o.cert === 'string' && typeof o.key === 'string';
}

Try / catch

try { await getCertificate(fs, opts); }
catch (e) {
  if (/Certificate and\/or key not found/.test(e.message)) {
    // regenerate or fix paths, then retry
  } else throw e;
}

Prevention

Use absolute paths for --cert/--key.
Commit a script to regenerate self-signed certs (mkcert) for new checkouts.
Verify file readability (permissions) before starting the dev server.

When it happens

Trigger: Starting `parcel serve`/`parcel dev` with --cert and --key flags (or HTTPSOptions) pointing to paths that do not exist, are unreadable, or are directories.

Common situations: Cert/key path typos; relative paths resolved against the wrong cwd; certs gitignored and missing after clone; permission/ownership issues on the key file; passing only one of cert/key.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of parcel-bundler/parcel@59484858a1 (2026-08-13). Data as JSON: /api/errors/a985b3b46f73b8bc. Report an issue: GitHub.