Certificate errors can originate from many different tools (curl, Node, Python, Deno, Rust's cargo, git, Ruby's bundler, Elixir's hex, or Nix), each with its own way of pointing to a trusted certificate. Listing the exact variable for each makes it much faster to find and fix the right one instead of guessing.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up SSL_CERT_FILE, on Claude Code changelog.* Changed `CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST` sessions to ignore CA-bundle, tool-proxy, git TLS and git config variables like `SSL_CERT_FILE` in settings; under Claude Desktop, only in project settingschangelogsee the edit
Added sinceA small documentation edit on Enterprise network configuration touched a line naming NODE_EXTRA_CA_CERTS after this was published.By default, Claude Code trusts both its bundled Mozilla CA certificates and your operating system's certificate store. Reading the OS store requires a runtime with `tls.getCACertificates`: the native installer always has it, and npm instal…network-configsee the edit
Confirmed sinceAnthropic's documentation has since written up NODE_EXTRA_CA_CERTS, on Claude apps gateway deployment and operations.| CLI `/login`: "Could not verify the gateway's TLS certificate" or `SELF_SIGNED_CERT_IN_CHAIN` | Gateway's TLS chain is signed by a private CA not in the CLI host's trust store | Claude Code reads the OS trust store by default on the nati…claude-apps-gateway-deploysee the edit
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agreesAnthropic's documentation has since written up NODE_EXTRA_CA_CERTS, on Claude apps gateway deployment and operations.
