What
CA certificates are the files your computer uses to decide whether a secure (TLS) connection to a server can be trusted. This release changes how Claude Code builds that list.
- Pruning in the CLI: after loading CA certificates, any certificate whose issuer is not also in the list is dropped, with a log line reading "CA certs: Dropped ... certificate(s) that do not chain to a root in the CA list". Before, every certificate from the combined store and any extra certificates was kept. Pruning is skipped when
CLAUDE_CODE_CLIENT_CERTis set, and a new certificate-loading helper also reads that variable. - Gateway connections: the gateway's web requests, OIDC sign-in, Google sign-in and Postgres database connections now pass an explicit CA list built from
CLAUDE_CODE_CERT_STOREand theNODE_EXTRA_CA_CERTSfile. Before, no explicit list was passed. - Gateway startup: the list is installed as the default CA certificates at startup, and startup stops with an error if no CA certificate can be loaded, telling you to check
CLAUDE_CODE_CERT_STOREand theNODE_EXTRA_CA_CERTSfile. - Bad entries: certificate blocks that cannot be read are skipped with a warning, and
oidc.ca_cert_pemis now filtered against the CLI's deny list instead of being used as given.
Why
If you rely on a corporate or custom CA, check your setup. Certificates from the system store or NODE_EXTRA_CA_CERTS that lack their issuer in the list are now left out without a prompt, and a gateway that used to start can now refuse to start when no CA certificate is readable.
Names in the bundleCLAUDE_CODE_CERT_STORENODE_EXTRA_CA_CERTS
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up CLAUDE_CODE_CERT_STORE, on Claude Code changelog.
* \[VSCode] Fixed dictation failing behind a TLS-inspecting proxy when `NODE_EXTRA_CA_CERTS` is set only in `~/.claude/settings.json`; it now also follows `CLAUDE_CODE_CERT_STORE`changelog see the edit
Confirmed since
Anthropic's documentation has since written up NODE_EXTRA_CA_CERTS, on Claude Code changelog.
* \[VSCode] Changed the extension's own requests to filter their trusted certificates as the CLI does, and to trust the `NODE_EXTRA_CA_CERTS` file named in the environment or in user settingschangelog see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up NODE_EXTRA_CA_CERTS, on Claude Code changelog.