#4198 TLS hint blames a missing root CA and macOS for every invalid peer certificate failure

Summary

renderError appends the hint from tlsErrorHint (src/presentation/output/error_output.ts) to any error whose message contains invalid peer certificate. The hint says the root CA is not in the trust store, describes a macOS limitation, and recommends SSL_CERT_FILE. That is wrong or misleading for failures that are not a missing root, and it never mentions --ca-cert.

Reproduction

On Linux, against a server signed by a private CA, pass a different CA with the same subject name. swamp workflow cancel --server (on the fix for Lab #3702) printed:

Error: TLS certificate rejected: invalid peer certificate: BadSignature

Hint: The TLS certificate was rejected because its root CA is not in the Deno trust store, followed by the macOS explanation and the SSL_CERT_FILE workaround.

The user supplied a CA, and the useful advice is to check that file.

Expected

The hint fires only for an untrusted issuer, or its wording fits the failure. A wrong CA or an expired certificate should not be sent to SSL_CERT_FILE.

Notes

The trigger is in shared code, so workflow run --server should behave the same way, though only cancel was run for this report. diagnoseTlsMessage rewrites UnknownIssuer into text without the trigger, so that case gets --ca-cert guidance and no hint. An expired certificate was not run; it reaches the same branch by reading the code.