Improve certificate loading error messages by zanieb · Pull Request #18924 · astral-sh/uv

zanieb · 2026-04-08T16:48:03Z

Adds special-case validation for SSL_CERT_FILE and SSL_CERT_DIR where we actually check if webpki will accept the given certificates and, if not, emit a better error message about why. This means we perform eager validation of certificates, parsing them more than once since reqwest will parse them again on client build. Unfortunately, there's not a straight-forward way to provide our pre-parsed certificates to reqwest without doing a lot more work. Nor is there a clear way to retrieve the parsed certificates on error.

We use https://github.com/rusticata/x509-parser for parsing which seems reputable.

We may want to drop all invalid certificates instead, but that can be a future decision and this machinery can be reused for warnings.

Ideally webpki would just have better error messages, but that's a separate project.

zanieb · 2026-04-08T17:14:27Z

+                        write!(
+                            f,
+                            "; critical extensions: {}",
+                            critical_extensions
+                                .iter()
+                                .map(|oid| format!("`{oid}`"))
+                                .join(", ")
+                        )?;


We can't know which critical extensions are supported without hard-coding copies of webpki internals because they don't expose the values publicly.

This is probably good enough debugging information for now

nooscraft · 2026-04-08T17:57:56Z

In light of this certificate validation issue, should we update CONTRIBUTING.md to document the TLS backend changes?

Currently it mentions NASM for Windows but doesn't explain:

Why the TLS backend changed (ring → aws-lc-rs in 0.11.0)
That certificate validation became stricter
How to test certificate-related changes
What info to provide for certificate issues

zanieb · 2026-04-08T18:01:57Z

In light of this certificate validation issue, should we update CONTRIBUTING.md to document the TLS backend changes?

What do you mean?

zanieb · 2026-04-08T18:04:27Z

I don't think the contributing guide is intended to cover debugging certificate issues, no. It's just covering how to build and test the project there. If certificate problems are commonplace and we can't improve the error messages, we can revisit troubleshooting documentation.

zsol · 2026-04-08T19:00:19Z

+                    source.path().simplified_display(),
+                    source.env_var()
+                )?;
+                if let Some(certificate) = certificate.parse() {


Should we also log something when the cert fails to parse?

zsol · 2026-04-08T19:01:51Z

+                )?;
+                if let Some(certificate) = certificate.parse() {
+                    let subject = certificate.subject();
+                    if subject.iter_attributes().next().is_some() {


I can't figure out why this condition is important, maybe worth a comment

I think it's to assert that the subject is non-empty, but it's a bit weird as-written

Minor thing, but worth noting that leaf certificates might have an empty subject and non-empty SANs instead.

(In practice I'd mostly expect this error to occur with CAs rather than leaves though.)

zsol · 2026-04-08T19:04:13Z

+                        write!(
+                            f,
+                            "; critical extensions: {}",
+                            critical_extensions
+                                .iter()
+                                .map(|oid| format!("`{oid}`"))
+                                .join(", ")
+                        )?;


This is probably good enough debugging information for now

zsol · 2026-04-08T19:05:10Z

+                    source.path().simplified_display(),
+                    source.env_var()
+                )?;
+                if let Some(certificate) = certificate.parse() {


Same note here: maybe worth logging something if the cert doesn't parse

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [uv](https://github.com/astral-sh/uv) | patch | `0.11.3` → `0.11.5` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>astral-sh/uv (uv)</summary> ### [`v0.11.5`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0115) [Compare Source](astral-sh/uv@0.11.4...0.11.5) Released on 2026-04-08. ##### Python - Add CPython 3.13.13, 3.14.4, and 3.15.0a8 ([#18908](astral-sh/uv#18908)) ##### Enhancements - Fix `build_system.requires` error message ([#18911](astral-sh/uv#18911)) - Remove trailing path separators in path normalization ([#18915](astral-sh/uv#18915)) - Improve error messages for unsupported or invalid TLS certificates ([#18924](astral-sh/uv#18924)) ##### Preview features - Add `exclude-newer` to `[[tool.uv.index]]` ([#18839](astral-sh/uv#18839)) - `uv audit`: add context/warnings for ignored vulnerabilities ([#18905](astral-sh/uv#18905)) ##### Bug fixes - Normalize persisted fork markers before lock equality checks ([#18612](astral-sh/uv#18612)) - Clear junction properly when uninstalling Python versions on Windows ([#18815](astral-sh/uv#18815)) - Report error cleanly instead of panicking on TLS certificate error ([#18904](astral-sh/uv#18904)) ##### Documentation - Remove the legacy `PIP_COMPATIBILITY.md` redirect file ([#18928](astral-sh/uv#18928)) - Fix `uv init example-bare --bare` examples ([#18822](astral-sh/uv#18822), [#18925](astral-sh/uv#18925)) ### [`v0.11.4`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0114) [Compare Source](astral-sh/uv@0.11.3...0.11.4) Released on 2026-04-07. ##### Enhancements - Add support for `--upgrade-group` ([#18266](astral-sh/uv#18266)) - Merge repeated archive URL hashes by version ID ([#18841](astral-sh/uv#18841)) - Require all direct URL hash algorithms to match ([#18842](astral-sh/uv#18842)) ##### Bug fixes - Avoid panics in environment finding via cycle detection ([#18828](astral-sh/uv#18828)) - Enforce direct URL hashes for `pyproject.toml` dependencies ([#18786](astral-sh/uv#18786)) - Error on `--locked` and `--frozen` when script lockfile is missing ([#18832](astral-sh/uv#18832)) - Fix `uv export` extra resolution for workspace member and conflicting extras ([#18888](astral-sh/uv#18888)) - Include conflicts defined in virtual workspace root ([#18886](astral-sh/uv#18886)) - Recompute relative `exclude-newer` values during `uv tree --outdated` ([#18899](astral-sh/uv#18899)) - Respect `--exclude-newer` in `uv tool list --outdated` ([#18861](astral-sh/uv#18861)) - Sort by comparator to break specifier ties ([#18850](astral-sh/uv#18850)) - Store relative timestamps in tool receipts ([#18901](astral-sh/uv#18901)) - Track newly-activated extras when determining conflicts ([#18852](astral-sh/uv#18852)) - Patch `Cargo.lock` in `uv-build` source distributions ([#18831](astral-sh/uv#18831)) ##### Documentation - Clarify that `--exclude-newer` compares artifact upload times ([#18830](astral-sh/uv#18830)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

Follows #18924

Closes #18890 Resolves the unexpected regression in 0.11 where `rustls-native-certs` was previously performing filtering and switching to populating certificates in reqwest ourselves resulted in stricter validation. Follows #18924 which added pre-validation of certificates with better error messages. We retain some of the error infrastructure for formatting a warning, but no longer propagate it upward. We emit a log instead of a noisy user-facing warning because they are often powerless to fix this and it's only consequential if they attempt to communicate with a service that requires the certificate (at which point, we'd just fail anyway). Ideally, there's an upstream resolution in rustls/webpki#464 as we're still reading and validating all of these certificates more than once.