certdoctorFix guides
Every runtime keeps its own list of trusted authorities. Each guide says where one of them keeps it and how to add a certificate to it.
A company root added to the Windows store reaches the browser and the programs that read that store. It does not reach a JDK’s cacerts, Git for Windows’ bundle, Node.js’ built-in list or the file Python reads. Each of those needs the certificate added where it looks.
certdoctor tells you which of them refuse, on the machine where it fails, and prints the command for each one with that machine’s paths in it. These guides explain what those commands do, so you can run them knowing what changes.
Java cacerts and keytool
Import a company root into Java cacerts with keytool, find every JDK and JRE on the machine, and see which still refuse, with the command for each.
Git and SSL certificates
Fix git SSL certificate problem: unable to get local issuer certificate. Which CA bundle each git reads, Schannel, and the command to add a root.
curl and its CA bundle
Fix curl (60) SSL certificate problem. Which CA bundle or store each curl reads, Schannel on Windows, CURL_CA_BUNDLE, and the command that adds a root.
Node.js and npm
Fix SELF_SIGNED_CERT_IN_CHAIN in Node.js and npm: NODE_USE_SYSTEM_CA to trust the system store, NODE_EXTRA_CA_CERTS to add a root, and which to use.
Python and pip certificates
Fix pip and Python CERTIFICATE_VERIFY_FAILED: which list each Python and pip trusts, certifi, truststore from pip 24.2, REQUESTS_CA_BUNDLE, PIP_CERT.
The Windows certificate store
Add a root certificate to the Windows certificate store with certutil: CurrentUser or LocalMachine, which programs read each, and which programs ignore both.
The Linux CA bundle
Add a root certificate to the Linux CA bundle on Debian, Ubuntu, Alpine and RHEL: which file programs read, update-ca-certificates, and what survives a rebuild.
TLS inspection
Behind a corporate proxy with TLS inspection, Java, git, npm and pip fail while the browser works. See who signed the certificate and where it is missing.
Test a PAC file
Find which proxy a PAC script picks for a URL, run the script your machine uses or any script by its address, and compare it with the other proxy settings.