{"version":"2.1.232","anchor":"mismatched-mtls-client-certificate-and-key-are-ignored-inste","canonical_anchor":"mismatched-mtls-client-certificate-and-key-are-ignored-inste","heading":"Mismatched mTLS client certificate and key are ignored instead of installed","tier":"notice","area":"Internals","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232\/e\/mismatched-mtls-client-certificate-and-key-are-ignored-inste","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232","markdown":"### Mismatched mTLS client certificate and key are ignored instead of installed\n\nA mismatched client certificate and key pair is now ignored and logged instead of installed.\n\n**What**\n\nWhen `CLAUDE_CODE_CLIENT_CERT` and `CLAUDE_CODE_CLIENT_KEY` do not belong together, typically mid-rotation, the loader now logs \"mTLS: Ignoring mismatched client cert\/key pair\" and keeps the previously loaded pair rather than installing a broken one.\n\n**Details**\n\n- The pair is verified with Node's `X509Certificate.checkPrivateKey`, honouring `CLAUDE_CODE_CLIENT_KEY_PASSPHRASE`.\n- Certificate blocks are located with a new PEM block pattern, so a bundle containing several certificates is handled.\n\n**Evidence**\n\n`mTLS: Ignoring mismatched client cert\/key pair`\n\n- Area: Internals\n- Names: `CLAUDE_CODE_CLIENT_CERT`, `CLAUDE_CODE_CLIENT_KEY`\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}