usebruno/bruno · error · Error

certFilePath is required for cert type

Error message

certFilePath is required for cert type

What it means

When a client certificate entry has type 'cert' (the default), the loader requires clientCert.certFilePath to be set. A falsy value throws before any path resolution or file read.

Source

Thrown at packages/bruno-requests/src/utils/http-https-agents.ts:284

  }

  // client certificate config
  const clientCertConfig = get(clientCertificates, 'certs', []) as ClientCertificate[];

  for (const clientCert of clientCertConfig) {
    if (clientCert?.disabled) {
      continue;
    }
    const domain = clientCert?.domain;
    const type = clientCert?.type || 'cert';
    if (domain) {
      const hostRegex = '^(https:\\/\\/|grpc:\\/\\/|grpcs:\\/\\/)?' + domain.replace(/\./g, '\\.').replace(/\*/g, '.*');
      if (requestUrl && requestUrl.match(hostRegex)) {
        if (type === 'cert') {
          try {
            let certFilePath = clientCert?.certFilePath;
            if (!certFilePath) {
              throw new Error('certFilePath is required for cert type');
            }
            certFilePath = path.isAbsolute(certFilePath) ? certFilePath : path.join(collectionPath, certFilePath);
            let keyFilePath = clientCert?.keyFilePath;
            if (!keyFilePath) {
              throw new Error('keyFilePath is required for cert type');
            }
            keyFilePath = path.isAbsolute(keyFilePath) ? keyFilePath : path.join(collectionPath, keyFilePath);

            certsConfig.cert = fs.readFileSync(certFilePath);
            certsConfig.key = fs.readFileSync(keyFilePath);
          } catch (err: any) {
            console.error('Error reading cert/key file', err);
            throw new Error(`Error reading cert/key file: ${err.message}`);
          }
        } else if (type === 'pfx') {
          try {
            let pfxFilePath = clientCert?.pfxFilePath;
            if (!pfxFilePath) {

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Open the collection's Client Certificates settings and select a cert file for the matching domain entry.
2. Ensure the persisted clientCert object includes certFilePath (and keyFilePath) before issuing the request.
3. If the cert is genuinely absent, disable the entry (clientCert.disabled = true) so it is skipped.

Example fix

// before
{ domain:'api.example.com', type:'cert', keyFilePath:'/k.pem' } // no certFilePath

// after
{ domain:'api.example.com', type:'cert', certFilePath:'/c.pem', keyFilePath:'/k.pem' }

for (const cc of clientCertificates?.certs ?? []) {
  if (!cc.disabled && cc.type !== 'pfx' && !cc.certFilePath) throw new Error(`certFilePath missing for domain ${cc.domain}`);
}

function isValidCertEntry(c): boolean { return c?.type === 'pfx' ? !!c.pfxFilePath : !!c?.certFilePath && !!c?.keyFilePath; }

When it happens

Trigger: A clientCertificates entry matches the request URL's domain and is enabled, but its certFilePath field is empty/undefined while type is 'cert'.

Common situations: User created a client-cert row, filled the domain, but forgot to pick the cert file; JSON config hand-edited and the certFilePath key dropped; migration from an older schema that did not store certFilePath.

Related errors

• keyFilePath is required for cert type
• pfxFilePath is required for pfx type
• Workspace path is required
• Workspace configuration must be an object
• Invalid workspace: not a bruno workspace

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/e65dc4278f9a9781. Report an issue: GitHub.