{"version":"2.1.221","anchor":"windows-sandbox-tls-termination-can-now-use-the-managed-sand","canonical_anchor":"windows-sandbox-tls-termination-can-now-use-the-managed-sand","heading":"Windows sandbox TLS termination can now use the managed sandbox CA","tier":"soon","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/windows-sandbox-tls-termination-can-now-use-the-managed-sand","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### Windows sandbox TLS termination can now use the managed sandbox CA\n\nWindows sandbox TLS interception could use a persistent managed certificate authority, but that path is disabled here.\n\n**What**\n\nCA resolution for sandbox.network.tlsTerminate was reworked, and on Windows a persistent sandbox-managed CA can be used instead of an ephemeral one, though that path is switched off in this build.\n\n**Details**\n\n- Three CA sources now exist: a trusted caCertPath\/caKeyPath pair from settings, a \"managed\" CA, or unavailable, with a certificate-thumbprint check that reads the managed CA cert from disk.\n- On native Windows an ephemeral CA cannot pass the sandbox trust check; the managed CA is set up via `\/sandbox install`, and the settings description documents this.\n- Trust failures now throw typed errors carrying codes rather than plain Error objects.\n- The old refusal message about missing caCertPath\/caKeyPath is replaced by one saying the managed CA is gated off.\n- The managed-CA path is Windows-only and gated on CLAUDE_CODE_NANKEEN_KESTREL, else `tengu_nankeen_kestrel` with an in-source fallback of false, so it is disabled by default here.\n\n**Evidence**\n\n`On native Windows an ephemeral CA cannot pass the sandbox trust check`, `[sandbox] settings tlsTerminate has no CA paths and the managed sandbox CA is gated off on Windows`\n\n- Flag `tengu_nankeen_kestrel`: Not enough to say (read for one account on one subscription tier against v2.1.221; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.\n- Area: Sandbox\n- Names: `CLAUDE_CODE_NANKEEN_KESTREL`, `\/sandbox install`, `sandbox.network.tlsTerminate`, `caCertPath`, `caKeyPath`\n- Tier: Nothing to try yet\n- Useful: 3\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}