From fbcffc85fdfe3516ead3906c2ac67fd9479647bb Mon Sep 17 00:00:00 2001
From: Roo Code <roomote@roocode.com>
Date: Sun, 16 Nov 2025 02:59:37 +0000
Subject: [PATCH] fix: handle X509 certificate errors for Ollama on Windows

- Add specific error handling for X509 to PEM conversion errors
- Add certificate validation error messages to help Windows users
- Disable automatic retries in Ollama client for clearer error messages
- Add localized error messages for certificate issues

Fixes #9291
---
 src/api/providers/ollama.ts                     |  9 ++++++++-
 src/api/providers/utils/openai-error-handler.ts | 15 +++++++++++++++
 src/i18n/locales/en/common.json                 |  4 +++-
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/src/api/providers/ollama.ts b/src/api/providers/ollama.ts
index ab9df116aa..49d2fa8e7c 100644
--- a/src/api/providers/ollama.ts
+++ b/src/api/providers/ollama.ts
@@ -36,11 +36,18 @@ export class OllamaHandler extends BaseProvider implements SingleCompletionHandl
 			headers["Authorization"] = `Bearer ${this.options.ollamaApiKey}`
 		}
 
+		const baseUrl = this.options.ollamaBaseUrl || "http://localhost:11434"
+
+		// For localhost connections, we may encounter certificate issues on Windows
+		// The error handler will catch and provide helpful messages for these cases
+
 		this.client = new OpenAI({
-			baseURL: (this.options.ollamaBaseUrl || "http://localhost:11434") + "/v1",
+			baseURL: baseUrl + "/v1",
 			apiKey: apiKey,
 			timeout: getApiRequestTimeout(),
 			defaultHeaders: headers,
+			dangerouslyAllowBrowser: false,
+			maxRetries: 0, // Disable automatic retries to get clearer error messages
 		})
 	}
 
diff --git a/src/api/providers/utils/openai-error-handler.ts b/src/api/providers/utils/openai-error-handler.ts
index d148406c33..03c2639f0b 100644
--- a/src/api/providers/utils/openai-error-handler.ts
+++ b/src/api/providers/utils/openai-error-handler.ts
@@ -27,6 +27,21 @@ export function handleOpenAIError(error: unknown, providerName: string): Error {
 			return new Error(i18n.t("common:errors.api.invalidKeyInvalidChars"))
 		}
 
+		// X509 to PEM conversion error - typically certificate validation issues on Windows
+		if (msg.includes("X509 to PEM conversion") || msg.includes("X509_to_PEM")) {
+			return new Error(i18n.t("common:errors.api.certificateError"))
+		}
+
+		// Certificate validation errors
+		if (
+			msg.includes("certificate") ||
+			msg.includes("CERT_") ||
+			msg.includes("self signed") ||
+			msg.includes("self-signed")
+		) {
+			return new Error(i18n.t("common:errors.api.certificateValidation"))
+		}
+
 		// For other Error instances, wrap with provider-specific prefix
 		return new Error(`${providerName} completion error: ${msg}`)
 	}
diff --git a/src/i18n/locales/en/common.json b/src/i18n/locales/en/common.json
index 784540e06f..9e9976d348 100644
--- a/src/i18n/locales/en/common.json
+++ b/src/i18n/locales/en/common.json
@@ -121,7 +121,9 @@
 			"authenticationRequired": "Roo provider requires cloud authentication. Please sign in to Roo Code Cloud."
 		},
 		"api": {
-			"invalidKeyInvalidChars": "API key contains invalid characters."
+			"invalidKeyInvalidChars": "API key contains invalid characters.",
+			"certificateError": "Certificate error when connecting to Ollama. For localhost connections, this is usually a false positive. Try restarting Ollama or check your certificate configuration.",
+			"certificateValidation": "Certificate validation failed. For local Ollama instances, ensure Ollama is running correctly. For remote instances, verify the SSL certificate is valid."
 		},
 		"manual_url_empty": "Please enter a valid callback URL",
 		"manual_url_no_query": "Invalid callback URL: missing query parameters",