CA certificate loading is stricter in the CLI and the gateway

What

CA certificates are the files your computer uses to decide whether a secure (TLS) connection to a server can be trusted. This release changes how Claude Code builds that list.

• Pruning in the CLI: after loading CA certificates, any certificate whose issuer is not also in the list is dropped, with a log line reading "CA certs: Dropped ... certificate(s) that do not chain to a root in the CA list". Before, every certificate from the combined store and any extra certificates was kept. Pruning is skipped when CLAUDE_CODE_CLIENT_CERT is set, and a new certificate-loading helper also reads that variable.
• Gateway connections: the gateway's web requests, OIDC sign-in, Google sign-in and Postgres database connections now pass an explicit CA list built from CLAUDE_CODE_CERT_STORE and the NODE_EXTRA_CA_CERTS file. Before, no explicit list was passed.
• Gateway startup: the list is installed as the default CA certificates at startup, and startup stops with an error if no CA certificate can be loaded, telling you to check CLAUDE_CODE_CERT_STORE and the NODE_EXTRA_CA_CERTS file.
• Bad entries: certificate blocks that cannot be read are skipped with a warning, and oidc.ca_cert_pem is now filtered against the CLI's deny list instead of being used as given.

Why

If you rely on a corporate or custom CA, check your setup. Certificates from the system store or NODE_EXTRA_CA_CERTS that lack their issuer in the list are now left out without a prompt, and a gateway that used to start can now refuse to start when no CA certificate is readable.