@@ -334,6 +334,8 @@ rcgen = { version = "0.14.5", features = [
 ], default-features = false }
 rustls = { version = "0.23.36", default-features = false }
 similar = { version = "2.6.0" }
+webpki = { package = "rustls-webpki", version = "0.103.10" }
+x509-parser = { version = "0.18.0" }
 temp-env = { version = "0.3.6", features = ["async_closure"] }
 test-case = { version = "3.3.1" }
 test-log = { version = "0.2.16", features = [
 
@@ -63,6 +63,8 @@ rustc-hash = { workspace = true }
 rustls-native-certs = { workspace = true }
 rustls-pki-types = { workspace = true }
 serde = { workspace = true }
+webpki = { workspace = true }
+x509-parser = { workspace = true }
 serde_json = { workspace = true }
 uv-platform = { workspace = true }
 thiserror = { workspace = true }
 
@@ -47,7 +47,7 @@ use uv_warnings::warn_user_once;
 
 use crate::linehaul::LineHaul;
 use crate::middleware::OfflineMiddleware;
-use crate::tls::{Certificates, read_identity};
+use crate::tls::{Certificates, TlsConfigurationError, read_identity};
 use crate::{Connectivity, WrappedReqwestError};
 
 pub const DEFAULT_RETRIES: u32 = 3;
@@ -71,6 +71,44 @@ pub const DEFAULT_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
 /// timeout on the entire upload.
 pub const DEFAULT_READ_TIMEOUT_UPLOAD: Duration = Duration::from_mins(15);
 
+#[derive(Debug)]
+pub struct ClientBuildError(ClientBuildErrorKind);
+
+#[derive(Debug, Error)]
+enum ClientBuildErrorKind {
+    #[error(transparent)]
+    Reqwest(reqwest::Error),
+    #[error(transparent)]
+    TlsConfiguration(TlsConfigurationError),
+}
+
+impl std::fmt::Display for ClientBuildError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str("failed to build HTTP client")
+    }
+}
+
+impl std::error::Error for ClientBuildError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match &self.0 {
+            ClientBuildErrorKind::Reqwest(error) => Some(error),
+            ClientBuildErrorKind::TlsConfiguration(error) => Some(error),
+        }
+    }
+}
+
+impl From<reqwest::Error> for ClientBuildError {
+    fn from(error: reqwest::Error) -> Self {
+        Self(ClientBuildErrorKind::Reqwest(error))
+    }
+}
+
+impl From<TlsConfigurationError> for ClientBuildError {
+    fn from(error: TlsConfigurationError) -> Self {
+        Self(ClientBuildErrorKind::TlsConfiguration(error))
+    }
+}
+
 /// Selectively skip parts or the entire auth middleware.
 #[derive(Debug, Clone, Copy, Default)]
 pub enum AuthIntegration {
@@ -380,7 +418,7 @@ impl<'a> BaseClientBuilder<'a> {
         retry_policy(self.retries, self.no_retry_delay)
     }
 
-    pub fn build(&self) -> reqwest::Result<BaseClient> {
+    pub fn build(&self) -> Result<BaseClient, ClientBuildError> {
         if let Some(name) = self.client_name {
             debug!(
                 "Using request connect timeout of {}s and read timeout of {}s for {} client",
@@ -464,7 +502,7 @@ impl<'a> BaseClientBuilder<'a> {
         &self,
         read_timeout: Duration,
         connect_timeout: Duration,
-    ) -> reqwest::Result<(Client, Client)> {
+    ) -> Result<(Client, Client), ClientBuildError> {
         // Create user agent.
         let mut user_agent_string = format!("uv/{}", version());
 
@@ -475,7 +513,7 @@ impl<'a> BaseClientBuilder<'a> {
         }
 
         // Load custom CA certificates from `SSL_CERT_FILE` and `SSL_CERT_DIR`.
-        let custom_certs = Certificates::from_env().map(|certs| certs.to_reqwest_certs());
+        let custom_certs = Certificates::from_env()?.map(|certs| certs.to_reqwest_certs());
 
         // Create a secure client that validates certificates.
         let raw_client = self.create_client(
@@ -508,7 +546,7 @@ impl<'a> BaseClientBuilder<'a> {
         custom_certs: Option<Vec<Certificate>>,
         security: Security,
         redirect_policy: RedirectPolicy,
-    ) -> reqwest::Result<Client> {
+    ) -> Result<Client, ClientBuildError> {
         // Configure the builder.
         let client_builder = ClientBuilder::new()
             .http1_title_case_headers()
@@ -574,7 +612,7 @@ impl<'a> BaseClientBuilder<'a> {
             client_builder = client_builder.proxy(proxy);
         }
 
-        client_builder.build()
+        client_builder.build().map_err(Into::into)
     }
 
     fn apply_middleware(&self, client: Client) -> ClientWithMiddleware {
 
@@ -1,7 +1,7 @@
 pub use base_client::{
-    AuthIntegration, BaseClient, BaseClientBuilder, DEFAULT_CONNECT_TIMEOUT, DEFAULT_MAX_REDIRECTS,
-    DEFAULT_READ_TIMEOUT, DEFAULT_READ_TIMEOUT_UPLOAD, DEFAULT_RETRIES, ExtraMiddleware,
-    RedirectClientWithMiddleware, RedirectPolicy, RequestBuilder, RetriableError,
+    AuthIntegration, BaseClient, BaseClientBuilder, ClientBuildError, DEFAULT_CONNECT_TIMEOUT,
+    DEFAULT_MAX_REDIRECTS, DEFAULT_READ_TIMEOUT, DEFAULT_READ_TIMEOUT_UPLOAD, DEFAULT_RETRIES,
+    ExtraMiddleware, RedirectClientWithMiddleware, RedirectPolicy, RequestBuilder, RetriableError,
     RetryParsingError, RetryState, UvRetryableStrategy, fetch_with_url_fallback,
     retryable_on_request_failure,
 };
 
@@ -37,7 +37,7 @@ use uv_redacted::DisplaySafeUrl;
 use uv_small_str::SmallString;
 use uv_torch::TorchStrategy;
 
-use crate::base_client::{BaseClientBuilder, ExtraMiddleware, RedirectPolicy};
+use crate::base_client::{BaseClientBuilder, ClientBuildError, ExtraMiddleware, RedirectPolicy};
 use crate::cached_client::CacheControl;
 use crate::flat_index::FlatIndexEntry;
 use crate::html::SimpleDetailHTML;
@@ -163,7 +163,7 @@ impl<'a> RegistryClientBuilder<'a> {
         }
     }
 
-    pub fn build(mut self) -> reqwest::Result<RegistryClient> {
+    pub fn build(mut self) -> Result<RegistryClient, ClientBuildError> {
         self.cache_index_credentials();
         let index_urls = self.index_locations.index_urls();
Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ use uv_redacted::DisplaySafeUrl;`
`37`	`37`	`use uv_small_str::SmallString;`
`38`	`38`	`use uv_torch::TorchStrategy;`
`39`	`39`
`40`		`-use crate::base_client::{BaseClientBuilder, ExtraMiddleware, RedirectPolicy};`
	`40`	`+use crate::base_client::{BaseClientBuilder, ClientBuildError, ExtraMiddleware, RedirectPolicy};`
`41`	`41`	`use crate::cached_client::CacheControl;`
`42`	`42`	`use crate::flat_index::FlatIndexEntry;`
`43`	`43`	`use crate::html::SimpleDetailHTML;`
`@@ -163,7 +163,7 @@ impl<'a> RegistryClientBuilder<'a> {`
`163`	`163`	`}`
`164`	`164`	`}`
`165`	`165`
`166`		`- pub fn build(mut self) -> reqwest::Result<RegistryClient> {`
	`166`	`+ pub fn build(mut self) -> Result<RegistryClient, ClientBuildError> {`
`167`	`167`	`self.cache_index_credentials();`
`168`	`168`	`let index_urls = self.index_locations.index_urls();`
`169`	`169`