feat(cli): suggest DENO_TLS_CA_STORE on untrusted TLS certificate#34756
Merged
Conversation
When a TLS connection fails with an untrusted certificate chain (rustls `UnknownIssuer`), the error gave no guidance toward the secure fix. This is common with mkcert dev certs or a corporate TLS proxy whose root is in the OS trust store but not Deno's default Mozilla bundle. Add a terminal-error hint for the `UnknownIssuer` case suggesting `DENO_TLS_CA_STORE=mozilla,system` (with --unsafely-ignore-certificate-errors as an insecure fallback). The existing broad cert-error hint still covers other failures like expired or hostname-mismatch certs, where the CA store wouldn't help. Closes #25366
bartlomieju
enabled auto-merge (squash)
June 5, 2026 14:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a TLS connection fails because the certificate chain isn't trusted
(rustls reports
UnknownIssuer), the error pointed only at the insecure--unsafely-ignore-certificate-errorsbypass and gave no hint toward thesecure fix. This trips up people using
mkcertdev certificates or behinda corporate TLS proxy, whose root CA lives in the operating system trust
store but not in Deno's default Mozilla bundle, and the
DENO_TLS_CA_STORE=mozilla,systemworkaround is hard to discover.This adds a terminal-error hint for the
UnknownIssuercase that suggestsrunning with
DENO_TLS_CA_STORE=mozilla,system, keeping the insecurebypass as a fallback. It is matched specifically on
UnknownIssuerso thatother certificate failures (expired, hostname mismatch), where the CA store
wouldn't help, keep the existing bypass-only hint.
Closes #25366