{"version":"2.1.305","anchor":"gateway-uses-an-explicit-ca-list-from-claude-code-cert-store","canonical_anchor":"ca-certificate-list-now-drops-certificates-that-do-not-chain","heading":"CA certificate loading is stricter in the CLI and the gateway","tier":"notice","area":"Gateway","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305\/e\/gateway-uses-an-explicit-ca-list-from-claude-code-cert-store","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305","markdown":"### CA certificate loading is stricter in the CLI and the gateway\n\nClaude Code now drops CA certificates that do not chain to a root, and the gateway uses an explicit CA list and refuses to start if none loads\n\n**What**\n\nCA certificates are the files your computer uses to decide whether a secure (TLS) connection to a server can be trusted. This release changes how Claude Code builds that list.\n\n- Pruning in the CLI: after loading CA certificates, any certificate whose issuer is not also in the list is dropped, with a log line reading \"CA certs: Dropped ... certificate(s) that do not chain to a root in the CA list\". Before, every certificate from the combined store and any extra certificates was kept. Pruning is skipped when `CLAUDE_CODE_CLIENT_CERT` is set, and a new certificate-loading helper also reads that variable.\n\n- Gateway connections: the gateway's web requests, OIDC sign-in, Google sign-in and Postgres database connections now pass an explicit CA list built from `CLAUDE_CODE_CERT_STORE` and the `NODE_EXTRA_CA_CERTS` file. Before, no explicit list was passed.\n\n- Gateway startup: the list is installed as the default CA certificates at startup, and startup stops with an error if no CA certificate can be loaded, telling you to check `CLAUDE_CODE_CERT_STORE` and the `NODE_EXTRA_CA_CERTS` file.\n\n- Bad entries: certificate blocks that cannot be read are skipped with a warning, and `oidc.ca_cert_pem` is now filtered against the CLI's deny list instead of being used as given.\n\n**Why**\n\nIf you rely on a corporate or custom CA, check your setup. Certificates from the system store or `NODE_EXTRA_CA_CERTS` that lack their issuer in the list are now left out without a prompt, and a gateway that used to start can now refuse to start when no CA certificate is readable.\n\n- Area: Gateway\n- Names: `CLAUDE_CODE_CERT_STORE`, `NODE_EXTRA_CA_CERTS`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: yes"}