AgentFixboard
UnverifiedLast checked Hermes Agent#setup#transport

TLS clients fail after an install-environment rotation leaves a stale CA path

A long-lived Hermes process loses TLS after a package-manager environment rotation. Construction fails with RuntimeError: Failed to initialize OpenAI client: [Errno 2] No such file or directory.

From GitHub

NousResearch/hermes-agent

IssuePull request

Difficulty
Easy
Time
~5 min
Steps
2
Fixed in
—
Last checked

Unverified: we could not confirm from the sources that a fix shipped. Source: PR #140376 merged. Last checked 2026-10-19.

Symptom

A long-lived Hermes process loses TLS after a package-manager environment rotation. Construction fails with RuntimeError: Failed to initialize OpenAI client: [Errno 2] No such file or directory.

Evidence what you'll see

  • The httpx path surfaces FileNotFoundError as RuntimeError: Failed to initialize OpenAI client: [Errno 2] No such file or directory.
  • The requests path logs OSError: Could not find a suitable TLS CA certificate bundle, invalid path: /opt/data/installs/<hash>/environments/<deleted-env>/venv/lib/python3.14/site-packages/certifi/cacert.pem.
  • A gateway log line is WARNING tools.web_tools: Tool web_search returned error: {"error": "Error searching web: Could not find a suitable TLS CA certificate bundle, invalid path: .../certifi/cacert.pem"}. Only a process restart recovered.

Why it happens

certifi.where() keeps the CA path from the imported module's __file__. After the old environment directory is deleted, that path is gone. Pull request 140376 re-imports certifi when the path is dead, and on Windows writes a platform CA bundle under $HERMES_HOME/cache/platform-ca-bundle.pem when certifi cannot be recovered.

Affected versions

Long-lived Hermes processes such as a launchd messaging gateway. The requests path names Python 3.14 under /opt/data/installs/<hash>/environments/<deleted-env>/. The linked issue does not name a Hermes release tag.

Fix steps

0 of 2 done

Your check marks stay in this browser only.

How to check it worked

  • After deleting the previous environment directory, a new TLS client is built without [Errno 2] No such file or directory on cacert.pem.

If it still fails

  • No published release tag contains pull request 140376. Tags v0.22.0, v0.22.1, and v0.22.2 were compared against merge ccc695635094 and do not contain it.

Sources and credit

Summarized in our own words from these public reports. Credit goes to their authors.

Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change

Hit an error we don't cover? Submit it