{"name":"CLAUDE_CODE_CLIENT_CERT","slug":"claude-code-client-cert","family":"env","title":"Environment variables","noun":"environment variable","description":"Path to client certificate file for mTLS authentication","description_source":"docs","described_by":{"doc":"claude-code\/env-vars","title":"Environment variables"},"presence":{"first_seen":"2.1.138","removed_in":null,"in_current_build":true,"newest_mined":"2.1.309","builds":150,"mined_builds":150,"first_cited":{"version":"2.1.200","released_at":"2026-07-03 04:33:49","spans":1}},"aliases":[],"entries":[{"version":"2.1.305","anchor":"ca-certificate-list-now-drops-certificates-that-do-not-chain","heading":"Certificates that don't chain to a trusted root are now dropped","line":"Claude Code now discards CA certificates whose issuer isn't in its certificate list, unless `CLAUDE_CODE_CLIENT_CERT` is set","released_at":"2026-10-20 19:29:36","reason":"found in this entry's text"},{"version":"2.1.232","anchor":"rotated-client-certificates-are-picked-up-after-a-stale-conn","heading":"Rotated client certificates are picked up after a stale connection","line":"Rotated client certificates are picked up mid-session, so you no longer have to restart after a rotation.","released_at":"2026-08-13 21:30:53","reason":"found in this entry's text"},{"version":"2.1.232","anchor":"mismatched-mtls-client-certificate-and-key-are-ignored-inste","heading":"Mismatched mTLS client certificate and key are ignored instead of installed","line":"A mismatched client certificate and key pair is now ignored and logged instead of installed.","released_at":"2026-08-13 21:30:53","reason":"named in this entry, found in this entry's text"},{"version":"2.1.232","anchor":"session-state-moved-into-named-stores-and-environment-reads-","heading":"Session state moved into named stores and environment reads centralised","line":"Session reset and model fallback use named stores, and cert env vars go through one accessor.","released_at":"2026-08-13 21:30:53","reason":"found in this entry's text"},{"version":"2.1.200","anchor":"mtls-certificate-hot-reload","heading":"mTLS Certificate Hot-Reload","line":null,"released_at":"2026-07-03 04:33:49","reason":"found in this entry's text"},{"version":"2.1.9","anchor":"ssl-tls-certificate-telemetry","heading":"SSL\/TLS Certificate Telemetry","line":null,"released_at":"2026-01-15 23:59:29","reason":"found in this entry's text"},{"version":"1.0.36","anchor":"mtls-mutual-tls-support","heading":"mTLS (Mutual TLS) Support","line":null,"released_at":"2025-06-27 17:07:11","reason":"found in this entry's text"}],"entries_total":7,"docs":[{"source":"claude-code","path":"env-vars","title":"Environment variables","documented":true},{"source":"claude-code","path":"monitoring-usage","title":"Monitoring","documented":false},{"source":"claude-code","path":"network-config","title":"Enterprise network configuration","documented":false},{"source":"claude-code","path":"server-managed-settings","title":"Configure server-managed settings","documented":false}],"docs_total":4,"gates":[],"related":[{"name":"CLAUDE_CODE_CLIENT_DATA_URL","slug":"claude-code-client-data-url","description":"`--client-data-url` or `CLAUDE_CODE_CLIENT_DATA_URL` loads a signed per-model configuration from Anthropic, and Claude Code will not start if it fails"},{"name":"CLAUDE_CODE_CLIENT_KEY","slug":"claude-code-client-key","description":"Path to client private key file for mTLS authentication"},{"name":"CLAUDE_CODE_CLIENT_KEY_PASSPHRASE","slug":"claude-code-client-key-passphrase","description":"Passphrase for encrypted CLAUDE\\_CODE\\_CLIENT\\_KEY (optional)"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/claude-code-client-cert","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}