{"version":"2.1.221","anchor":"sandbox-install-provisions-and-trusts-the-managed-tls-ca-on-","canonical_anchor":"sandbox-install-provisions-and-trusts-the-managed-tls-ca-on-","heading":"\/sandbox install provisions and trusts the managed TLS CA on Windows","tier":"use","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/sandbox-install-provisions-and-trusts-the-managed-tls-ca-on-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### \/sandbox install provisions and trusts the managed TLS CA on Windows\n\nOn Windows, sandboxed HTTPS now works after \/sandbox install without a manual certificate trust step.\n\n**What**\n\nThe Windows install path now creates and trusts the managed sandbox TLS inspection CA, so sandboxed HTTPS works without a manual trust step.\n\n**Details**\n\n- The install path became async and runs a CA trust step when the CA source is \"managed\".\n- Failures are reported as partial installs: \"The sandbox TLS inspection CA couldn't be trusted for the sandbox user: \" or \"The sandbox TLS inspection CA couldn't be created: \", both ending \"Sandboxed HTTPS won't work \u2014 run \/sandbox install again to retry.\".\n- Failures are recorded as \"trust_ca_failed\" and \"persistent_ca_failed\" under \"sandbox_windows_install\".\n- A UAC-cancelled install on an already-provisioned user can now still succeed, and the result message may gain \" Restart Claude Code to enable TLS inspection for this session.\"\n- Windows only, and the trust step only runs for a managed CA source.\n\n**Evidence**\n\n`sandbox_windows_install`\n\n- Area: Sandbox\n- Names: `\/sandbox install`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 0\/5"}