What
Claude Code loads CA certificates, the root certificates that decide which secure (TLS) connections it trusts. It reads them from three places: certificates bundled with Claude Code, the operating system's own store, and a file named by the NODE_EXTRA_CA_CERTS environment variable. That variable is a setting you can use to add your own certificates, often a company's certificate behind a corporate proxy. In this release the loader has been reworked:
- Each certificate is now kept as a
{pem, source}record, with the source being "bundled", "system" or "NODE_EXTRA_CA_CERTS". Before, the loader pushed plain PEM text into a single list. - System certificates now pass through a new helper before they are added.
- The combined list goes to a new step that removes duplicates and validates the certificates, together with the bundled root certificates.
- The per-host certificate state now holds a
warnedExtraCertsset. It is passed both to the step that assembles system and bundled certificates and to the step that appendsNODE_EXTRA_CA_CERTS.
The log lines are unchanged, for example CA certs: Loaded ${b.length} system CA certificates, CA certs: Appended extra certificates from NODE_EXTRA_CA_CERTS and CA certs: Nothing from NODE_EXTRA_CA_CERTS. The new helpers and the warning code were not read, so what they filter or report is unconfirmed.
Why
This is relevant if you use a custom certificate file or a corporate proxy. The changes may affect which certificates Claude Code ends up trusting and how it warns about extra certificates. A set of already-warned certificates suggests a warning about a problem certificate could appear once per host rather than repeatedly, but that has not been confirmed.