Rotated client certificates are picked up mid-session, so you no longer have to restart after a rotation.
What's wrong with this entry?
When a request fails at the TLS or socket layer, Claude Code re-reads the client certificate material and resets its connections if the files changed on disk, so a certificate rotated underneath a long-running session no longer needs a restart.
- Triggered on
EPROTO,FailedToOpenSocket, andERR_OSSL_/ERR_SSL_errors. - Only runs when a client certificate is configured via
CLAUDE_CODE_CLIENT_CERT. - Set
CLAUDE_CODE_DISABLE_MTLS_RELOAD_ON_STALE_CONNECTIONto skip the reload entirely. - Outcomes are reported under a new telemetry event.
CLAUDE_CODE_DISABLE_MTLS_RELOAD_ON_STALE_CONNECTION
Strings lifted out of the shipped bundle, so the claim above can be checked against them.