{"name":"NODE_EXTRA_CA_CERTS","slug":"node-extra-ca-certs","family":"env","title":"Environment variables","noun":"environment variable","description":"Session reset and model fallback use named stores, and cert env vars go through one accessor.","description_source":"entry","described_by":{"version":"2.1.232","anchor":"session-state-moved-into-named-stores-and-environment-reads-"},"presence":{"first_seen":"2.1.138","removed_in":null,"in_current_build":true,"newest_mined":"2.1.309","builds":150,"mined_builds":150,"first_cited":{"version":"2.1.70","released_at":"2026-03-06 00:09:06","spans":6}},"aliases":[],"entries":[{"version":"2.1.305","anchor":"ca-certificate-list-now-drops-certificates-that-do-not-chain","heading":"Certificates that don't chain to a trusted root are now dropped","line":"Claude Code now discards CA certificates whose issuer isn't in its certificate list, unless `CLAUDE_CODE_CLIENT_CERT` is set","released_at":"2026-10-20 19:29:36","reason":"found in this entry's text"},{"version":"2.1.305","anchor":"gateway-uses-an-explicit-ca-list-from-claude-code-cert-store","heading":"Gateway now refuses to start when no CA certificate can be loaded","line":"The gateway now passes an explicit certificate list on its connections and stops at startup if none can be loaded","released_at":"2026-10-20 19:29:36","reason":"found in this entry's text, named in this entry"},{"version":"2.1.303","anchor":"ca-loading-drops-deny-listed-root-certificates-and-falls-bac","heading":"Claude Code now refuses to trust a short built-in list of blocked root certificates","line":"Certificates on a built-in deny list are now dropped from every certificate source, including a NODE_EXTRA_CA_CERTS file","released_at":"2026-10-18 21:15:23","reason":"found in this entry's text"},{"version":"2.1.303","anchor":"ca-certificate-loading-now-tags-each-cert-with-its-source","heading":"Claude Code now records where each trusted certificate came from","line":"Each root certificate Claude Code loads is now labelled as bundled, from the system store, or from NODE_EXTRA_CA_CERTS","released_at":"2026-10-18 21:15:23","reason":"found in this entry's text"},{"version":"2.1.303","anchor":"ca-loading-now-filters-a-hardcoded-deny-list-of-four-root-ce","heading":"Blocked root certificates are dropped, and a missing system store falls back to bundled ones","line":"Claude Code drops four blocked root certificates from all sources and uses its bundled roots when the system store is unavailable","released_at":"2026-10-18 21:15:23","reason":"found in this entry's text"},{"version":"2.1.303","anchor":"ca-cert-state-now-keeps-a-set-of-already-warned-extra-certif","heading":"Claude Code keeps track of which extra certificates it has already warned about","line":"Claude Code now remembers which NODE_EXTRA_CA_CERTS certificates it has warned about, so the warning can be shown once","released_at":"2026-10-18 21:15:23","reason":"found in this entry's text"},{"version":"2.1.283","anchor":"claude-code-gb-base-url-added-to-the-protected-env-var-set-i","heading":"CLAUDE_CODE_GB_BASE_URL gets the same settings checks as the proxy variables","line":"CLAUDE_CODE_GB_BASE_URL joins the proxy, certificate and bridge variables that Claude Code checks when it cleans a settings file","released_at":"2026-09-25 18:46:11","reason":"found in this entry's text"},{"version":"2.1.275","anchor":"ca-cert-troubleshooting-message-now-lists-concrete-env-vars","heading":"CA-cert troubleshooting message now lists concrete env vars","line":"SSL certificate error message now lists the specific env var to check per tool","released_at":"2026-09-17 20:20:31","reason":"found in this entry's text, named in this entry"},{"version":"2.1.273","anchor":"ssl-certificate-errors-now-include-a-docs-link-and-a-plainer","heading":"SSL certificate errors now include a docs link and a plainer explanation","line":"SSL certificate errors now explain the likely corporate-proxy cause and link to setup docs","released_at":"2026-09-15 18:06:34","reason":"found in this entry's text, named in this entry"},{"version":"2.1.248","anchor":"custom-ca-no-longer-misreported-for-local-agent-runs","heading":"Custom CA no longer misreported for local agent runs","line":"Inherited certificate settings are no longer reported as your own custom CA in local agent runs.","released_at":"2026-08-27 20:35:36","reason":"named in this entry, found in this entry's text"}],"entries_total":17,"docs":[{"source":"claude-code","path":"amazon-bedrock","title":"Claude Code on Amazon Bedrock","documented":false},{"source":"claude-code","path":"changelog","title":"Claude Code changelog","documented":false},{"source":"claude-code","path":"claude-apps-gateway-deploy","title":"Claude apps gateway deployment and operations","documented":false},{"source":"claude-code","path":"claude-apps-gateway-on-aws","title":"Deploy Claude apps gateway on AWS","documented":false},{"source":"claude-code","path":"cloud-environments","title":"Configure cloud environments","documented":false},{"source":"claude-code","path":"desktop","title":"Desktop application","documented":false},{"source":"claude-code","path":"errors","title":"Error reference","documented":false},{"source":"claude-code","path":"llm-gateway-connect","title":"Connect Claude Code to an LLM gateway","documented":false},{"source":"claude-code","path":"monitoring-usage","title":"Monitoring","documented":false},{"source":"claude-code","path":"network-config","title":"Enterprise network configuration","documented":false}],"docs_total":12,"gates":[],"related":[{"name":"NODE_DEBUG","slug":"node-debug","description":"Read by bundled libraries: the `semver` library prints debug lines prefixed `SEMVER` to stderr when `NODE_DEBUG` contains the word `semver`, and `graceful-fs` logs its `GFS4` debug lines (through Node's `util.debuglog`) when it contains `gfs4`, also checking at exit that its retry queue is empty. The Google logging utility's debug-package backend writes to `NODE_DEBUG`, appending its log filters to the existing value."},{"name":"NODE_ENV","slug":"node-env","description":"Claude Code now keeps a list of the environment variables that affect telemetry and feature flags"},{"name":"NODE_OPTIONS","slug":"node-options","description":"Remotely managed settings can no longer redirect your bridge connection by setting that URL variable."},{"name":"NODE_PATH","slug":"node-path","description":null}],"url":"https:\/\/changelogs.core-directive.com\/reference\/env\/node-extra-ca-certs","family_url":"https:\/\/changelogs.core-directive.com\/reference\/env.json"}