CA certificate loading tags each certificate's source and remembers which extra certificates it has warned about

What

Claude Code loads CA certificates, the root certificates that decide which secure (TLS) connections it trusts. It reads them from three places: certificates bundled with Claude Code, the operating system's own store, and a file named by the NODE_EXTRA_CA_CERTS environment variable. That variable is a setting you can use to add your own certificates, often a company's certificate behind a corporate proxy. In this release the loader has been reworked:

• Each certificate is now kept as a {pem, source} record, with the source being "bundled", "system" or "NODE_EXTRA_CA_CERTS". Before, the loader pushed plain PEM text into a single list.
• System certificates now pass through a new helper before they are added.
• The combined list goes to a new step that removes duplicates and validates the certificates, together with the bundled root certificates.
• The per-host certificate state now holds a warnedExtraCerts set. It is passed both to the step that assembles system and bundled certificates and to the step that appends NODE_EXTRA_CA_CERTS.

The log lines are unchanged, for example CA certs: Loaded ${b.length} system CA certificates, CA certs: Appended extra certificates from NODE_EXTRA_CA_CERTS and CA certs: Nothing from NODE_EXTRA_CA_CERTS. The new helpers and the warning code were not read, so what they filter or report is unconfirmed.

Why

This is relevant if you use a custom certificate file or a corporate proxy. The changes may affect which certificates Claude Code ends up trusting and how it warns about extra certificates. A set of already-warned certificates suggests a warning about a problem certificate could appear once per host rather than repeatedly, but that has not been confirmed.