#4199 A malformed --ca-cert file is reported as an unreadable OS certificate store

Summary

When the file given to --ca-cert or SWAMP_CA_CERT contains a malformed PEM block, the error blames the OS certificate store and tells the user to set DENO_TLS_CA_STORE and pass --ca-cert, the flag they already used. Nothing points at their file.

Reproduction

Write a file containing a BEGIN CERTIFICATE line, a non-base64 line and an END CERTIFICATE line, then run swamp workflow run any-name --server wss://localhost:9 --token x.y --ca-cert that-file. The released binary and the fix for Lab #3702 on workflow cancel --server both print:

Error: Could not read the OS certificate store: Unable to add pem file to certificate store: InvalidByte(3, 32) — swamp defaults DENO_TLS_CA_STORE to system,mozilla; re-run with DENO_TLS_CA_STORE=mozilla to use Deno's bundled roots instead (also pass --ca-cert /path/to/ca.pem if the server needs a private root)

Where

createTlsHttpClient in src/cli/remote_run.ts labels every Deno.createHttpClient failure as a certificate store read failure.

Expected

A failure caused by the supplied CA certificates names the CA file and says it is not valid PEM.

Notes

A file with no PEM block at all, such as plain text, raises no error here and fails later at the connection.