{"version":"2.1.232","anchor":"rotated-client-certificates-are-picked-up-after-a-stale-conn","canonical_anchor":"rotated-client-certificates-are-picked-up-after-a-stale-conn","heading":"Rotated client certificates are picked up after a stale connection","tier":"notice","area":"Network Security","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232\/e\/rotated-client-certificates-are-picked-up-after-a-stale-conn","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.232","markdown":"### Rotated client certificates are picked up after a stale connection\n\nRotated client certificates are picked up mid-session, so you no longer have to restart after a rotation.\n\n**What**\n\nWhen a request fails at the TLS or socket layer, Claude Code re-reads the client certificate material and resets its connections if the files changed on disk, so a certificate rotated underneath a long-running session no longer needs a restart.\n\n**Details**\n\n- Triggered on `EPROTO`, `FailedToOpenSocket`, and `ERR_OSSL_*` \/ `ERR_SSL_*` errors.\n- Only runs when a client certificate is configured via `CLAUDE_CODE_CLIENT_CERT`.\n- Set `CLAUDE_CODE_DISABLE_MTLS_RELOAD_ON_STALE_CONNECTION` to skip the reload entirely.\n- Outcomes are reported under a new telemetry event.\n\n**Evidence**\n\n`CLAUDE_CODE_DISABLE_MTLS_RELOAD_ON_STALE_CONNECTION`\n\n- Area: Network Security\n- Names: `CLAUDE_CODE_DISABLE_MTLS_RELOAD_ON_STALE_CONNECTION`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5"}