react/create-react-app · error · Error

The certificate "${crtFile}" is invalid.\n${err.message}

Error message

The certificate "${crtFile}" is invalid.\n${err.message}

What it means

getHttpsConfig.validateKeyAndCerts sanity-checks the user-supplied SSL certificate by encrypting a test buffer with crypto.publicEncrypt. If that throws, the cert cannot be used for HTTPS and the error is re-thrown with the path (crtFile) and the underlying OpenSSL message. This prevents webpack-dev-server starting with a broken cert.

Source

Thrown at packages/react-scripts/config/getHttpsConfig.js:25

 */
// @remove-on-eject-end
'use strict';

const fs = require('fs');
const path = require('path');
const crypto = require('crypto');
const chalk = require('react-dev-utils/chalk');
const paths = require('./paths');

// Ensure the certificate and key provided are valid and if not
// throw an easy to debug error
function validateKeyAndCerts({ cert, key, keyFile, crtFile }) {
  let encrypted;
  try {
    // publicEncrypt will throw an error with an invalid cert
    encrypted = crypto.publicEncrypt(cert, Buffer.from('test'));
  } catch (err) {
    throw new Error(
      `The certificate "${chalk.yellow(crtFile)}" is invalid.\n${err.message}`
    );
  }

  try {
    // privateDecrypt will throw an error with an invalid key
    crypto.privateDecrypt(key, encrypted);
  } catch (err) {
    throw new Error(
      `The certificate key "${chalk.yellow(keyFile)}" is invalid.\n${
        err.message
      }`
    );
  }
}

// Read file and throw an error if it doesn't exist
function readEnvFile(file, type) {

View on GitHub (pinned to 6254386531)

Solutions

1. Regenerate a valid self-signed cert, e.g. `mkcert localhost` or `openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out cert.pem -days 365`.
2. Verify the file at SSL_CRT_FILE is a complete PEM cert: it begins with `-----BEGIN CERTIFICATE-----` and ends with the matching footer.
3. Ensure SSL_CRT_FILE and SSL_KEY_FILE are not swapped.
4. Confirm the cert encoding is PEM (base64), not DER/binary; convert if needed: `openssl x509 -in cert.der -inform DER -out cert.pem -outform PEM`.

Example fix

# before
SSL_CRT_FILE=./cert.txt        # malformed
SSL_KEY_FILE=./key.pem
# after
SSL_CRT_FILE=./cert.pem        # valid PEM cert
SSL_KEY_FILE=./key.pem

const fs = require('fs');
const crypto = require('crypto');
function validateCertFile(crtFile) {
  const cert = fs.readFileSync(crtFile);
  try {
    crypto.publicEncrypt(cert, Buffer.from('test'));
  } catch (e) {
    throw new Error(`SSL_CRT_FILE '${crtFile}' is not a valid cert: ${e.message}`);
  }
}
// before starting dev server:
if (process.env.SSL_CRT_FILE) validateCertFile(process.env.SSL_CRT_FILE);

const looksLikePemCert = (contents) =>
  /-----BEGIN CERTIFICATE-----/.test(contents) &&
  /-----END CERTIFICATE-----/.test(contents);

try {
  require('react-scripts/config/getHttpsConfig');
} catch (e) {
  if (/certificate .* is invalid/i.test(e.message)) {
    console.error('SSL_CRT_FILE is invalid. Regenerate with mkcert or openssl.');
    process.exit(1);
  }
  throw e;
}

When it happens

Trigger: SSL_CRT_FILE is set in .env to a file whose contents are not a valid PEM/X.509 certificate (malformed, wrong format, expired to the point of rejection, or partially written). crypto.publicEncrypt throws and the catch re-wraps it.

Common situations: Generating a cert with the wrong command/format. Copying only part of a PEM file. Editing the cert and introducing whitespace/encoding errors. Pointing SSL_CRT_FILE at the key file by mistake.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The certificate key "${keyFile}" is invalid.\n${err.message}
• You specified ${type} in your env, but the file "${file}" ca
• Preset react-app: '${name}' option must be a boolean.
• Preset react-app: '${name}' option must be a boolean.
• The NODE_ENV environment variable is required but was not sp

AI-assisted analysis of react/create-react-app@6254386531 (2026-08-12). Data as JSON: /api/errors/f75655febf2f315b. Report an issue: GitHub.