Network proxy changedthird-party/claude-desktop/network-proxy
Nearest release: v2.1.322, published 17 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 10 Nov 2026 19:22 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 10 Nov 2026 19:37 UTC.
Upstream edited
Recorded here
Lines+20added
Lines−15removed
From line
162
where the diff opens
First seen
2 Sep 2026
this site's first read of the page
Recorded edits20to this page, all time
The whole hunk
from line 162, old and new numbered
/
from line 162
162162
163163If your proxy performs TLS interception, it presents its own certificate authority. The app trusts the operating system's certificate store. On macOS, the app also configures the agent to trust the System keychain in addition to the bundled CA roots, so a corporate CA installed there normally works without extra setup. To clone a [git plugin marketplace](https://claude.com/docs/third-party/claude-desktop/extensions.md#plugin-marketplaces-admin), the app runs the device's `git`, which reads git's system-level configuration, not the user's own.
164164
165If inference or tool requests still fail certificate verification, the CA was likely added with policy-restricted trust: certificates installed via `security add-trusted-cert -p ssl …` are trusted by Safari and Chrome but are not picked up by the agent's keychain reader. Re-add the CA with full root trust (omit `-p`):
165On macOS, if the agent's inference requests or remote MCP connections still fail certificate verification, give the agent your private CA certificates as a file. Requires Claude Desktop 4.16336.0 or later.
166166
167```bash theme={null}
168sudo security add-trusted-cert -d -r trustRoot \
169 -k /Library/Keychains/System.keychain /path/to/corp-ca.pem
170```
1671. Create one PEM file with the root certificate of every private CA that sessions need. You can include intermediate certificates with their roots. In Chat and Cowork sessions, the agent uses this file in place of the CA list that the app gives it. A private CA that you leave out can stop working in those sessions.
171168
172If the certificate is MDM-managed and you cannot change how it is installed, set `NODE_EXTRA_CA_CERTS` as a fallback, then quit and relaunch Claude:
1692. Put the file at a path that every user of the device can read and only administrators can change.
173170
174```bash theme={null}
175security find-certificate -a -p /Library/Keychains/System.keychain > ~/corp-ca.pem
176launchctl setenv NODE_EXTRA_CA_CERTS "$HOME/corp-ca.pem"
177```
1713. Set `NODE_EXTRA_CA_CERTS` to that path in the `env` block of Claude Code [managed settings](#interaction-with-claude-code-managed-settings). If the device already has Claude Code managed settings, add the entry to them.
178172
179`launchctl setenv` makes the variable visible to apps launched from Finder or the Dock (shell-profile exports only reach terminal sessions). It applies until the next reboot; to make it permanent, run the command from a LaunchAgent at login.
173 ```json /Library/Application Support/ClaudeCode/managed-settings.json theme={null}
174 {
175 "env": {
176 "NODE_EXTRA_CA_CERTS": "/Library/Application Support/ClaudeCode/corp-ca.pem"
177 },
178 "parentSettingsBehavior": "merge"
179 }
180 ```
181
1824. Quit and reopen Claude Desktop.
183
184In Chat, Cowork, and local Code sessions, the agent then trusts the CA certificates in that file. A `NODE_EXTRA_CA_CERTS` value set with `launchctl setenv` has no effect on Claude Desktop.
180185
181186## Troubleshoot
182187
No line in this hunk matches that.