{"version":"2.1.303","anchor":"ca-cert-state-now-keeps-a-set-of-already-warned-extra-certif","canonical_anchor":"ca-certificate-loading-now-tags-each-cert-with-its-source","heading":"CA certificate loading tags each certificate's source and remembers which extra certificates it has warned about","tier":"internal","area":"TLS Certificates","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.303\/e\/ca-cert-state-now-keeps-a-set-of-already-warned-extra-certif","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.303","markdown":"### CA certificate loading tags each certificate's source and remembers which extra certificates it has warned about\n\nThe CA certificate loader now records where each certificate came from and keeps a per-host set of extra certificates it has already warned about\n\n**Unclear.** It is not confirmed that a warning about a given certificate is now shown only once.\n\n**What**\n\nClaude Code loads CA certificates, the root certificates that decide which secure (TLS) connections it trusts. It reads them from three places: certificates bundled with Claude Code, the operating system's own store, and a file named by the `NODE_EXTRA_CA_CERTS` environment variable. That variable is a setting you can use to add your own certificates, often a company's certificate behind a corporate proxy. In this release the loader has been reworked:\n\n- Each certificate is now kept as a `{pem, source}` record, with the source being \"bundled\", \"system\" or \"NODE_EXTRA_CA_CERTS\". Before, the loader pushed plain PEM text into a single list.\n\n- System certificates now pass through a new helper before they are added.\n\n- The combined list goes to a new step that removes duplicates and validates the certificates, together with the bundled root certificates.\n\n- The per-host certificate state now holds a `warnedExtraCerts` set. It is passed both to the step that assembles system and bundled certificates and to the step that appends `NODE_EXTRA_CA_CERTS`.\n\nThe log lines are unchanged, for example `CA certs: Loaded ${b.length} system CA certificates`, `CA certs: Appended extra certificates from NODE_EXTRA_CA_CERTS` and `CA certs: Nothing from NODE_EXTRA_CA_CERTS`. The new helpers and the warning code were not read, so what they filter or report is unconfirmed.\n\n**Why**\n\nThis is relevant if you use a custom certificate file or a corporate proxy. The changes may affect which certificates Claude Code ends up trusting and how it warns about extra certificates. A set of already-warned certificates suggests a warning about a problem certificate could appear once per host rather than repeatedly, but that has not been confirmed.\n\n- Area: TLS Certificates\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: no"}