macos.zsh exports NODE_EXTRA_CA_CERTS to a Caddy CA that may be absent, warning every Node child #94

New issue

Closed

opened 2026-05-28 23:19:49 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-28 23:19:49 +00:00

Owner

Symptom

Every Node process started from a macOS login shell that lacks the Caddy local CA emits this on startup:

warn: ignoring extra certs from /Users/<user>/Library/Application Support/Caddy/pki/authorities/local/root.crt, load failed: error:10000002:SSL routines:OPENSSL_internal:system library

First noticed in a coily dispatch child claude -p log, but it hits any Node binary (including interactive claude) in a login shell, since it comes from an exported env var.

Root cause

zsh/hosts/macos.zsh:26 exports the var unconditionally:

# Node: trust the local Caddy root CA for HTTPS dev work.
export NODE_EXTRA_CA_CERTS="$HOME/Library/Application Support/Caddy/pki/authorities/local/root.crt"

On this host ~/Library/Application Support/Caddy does not exist at all, so the CA file is absent. Node/BoringSSL then warns it cannot load the file and proceeds without it. The warning is benign (TLS still works), but it noises up every Node startup and every dispatch log.

Fix options

Guard the export on file existence (recommended). Only export when the file is readable: [[ -r "$crt" ]] && export NODE_EXTRA_CA_CERTS="$crt". Minimal, removes the warning, self-heals once Caddy generates the CA.
Resolve the real Caddy CA path on hosts where it lives elsewhere (different data dir, or via caddy trust) and point at that.
Drop the export if local Caddy MITM trust is no longer needed for HTTPS dev work.

Notes

Public-safe shell config, no secrets involved.
Confirm with Kai whether Caddy local-CA trust is still wanted on Macs before choosing guard vs resolve vs drop. The guard is safe regardless.

## Symptom Every Node process started from a macOS login shell that lacks the Caddy local CA emits this on startup: ``` warn: ignoring extra certs from /Users/<user>/Library/Application Support/Caddy/pki/authorities/local/root.crt, load failed: error:10000002:SSL routines:OPENSSL_internal:system library ``` First noticed in a `coily dispatch` child `claude -p` log, but it hits any Node binary (including interactive claude) in a login shell, since it comes from an exported env var. ## Root cause `zsh/hosts/macos.zsh:26` exports the var unconditionally: ```sh # Node: trust the local Caddy root CA for HTTPS dev work. export NODE_EXTRA_CA_CERTS="$HOME/Library/Application Support/Caddy/pki/authorities/local/root.crt" ``` On this host `~/Library/Application Support/Caddy` does not exist at all, so the CA file is absent. Node/BoringSSL then warns it cannot load the file and proceeds without it. The warning is benign (TLS still works), but it noises up every Node startup and every dispatch log. ## Fix options - **Guard the export on file existence** (recommended). Only export when the file is readable: `[[ -r "$crt" ]] && export NODE_EXTRA_CA_CERTS="$crt"`. Minimal, removes the warning, self-heals once Caddy generates the CA. - **Resolve the real Caddy CA path** on hosts where it lives elsewhere (different data dir, or via `caddy trust`) and point at that. - **Drop the export** if local Caddy MITM trust is no longer needed for HTTPS dev work. ## Notes - Public-safe shell config, no secrets involved. - Confirm with Kai whether Caddy local-CA trust is still wanted on Macs before choosing guard vs resolve vs drop. The guard is safe regardless.

coilysiren closed this issue

2026-05-29 00:56:35 +00:00

coilysiren referenced this issue from a commit

2026-05-29 18:44:22 +00:00

fix: guard NODE_EXTRA_CA_CERTS export on cert readability

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#94

No description provided.

Rows
Columns