SSL certificate error message now lists the specific env var to check per tool
The TLS/certificate troubleshooting message now names the specific flag or environment variable relevant to each tool that might be involved in a certificate error: --cacert, SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, REQUESTS_CA_BUNDLE, AWS_CA_BUNDLE, DENO_CERT, CARGO_HTTP_CAINFO, PIP_CERT, GIT_SSL_CAINFO, BUNDLE_SSL_CA_CERT, HEX_CACERTS_PATH, and NIX_SSL_CERT_FILE.
Certificate errors can originate from many different tools (curl, Node, Python, Deno, Rust's cargo, git, Ruby's bundler, Elixir's hex, or Nix), each with its own way of pointing to a trusted certificate. Listing the exact variable for each makes it much faster to find and fix the right one instead of guessing.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
| CLI `/login`: "Could not verify the gateway's TLS certificate" or `SELF_SIGNED_CERT_IN_CHAIN` | Gateway's TLS chain is signed by a private CA not in the CLI host's trust store | Claude Code reads the OS trust store by default on the nati…claude-apps-gateway-deploy see the edit
Anthropic's documentation has since written up NODE_EXTRA_CA_CERTS, on Claude apps gateway deployment and operations.