Unclear Which gateway setups use this allowlist, and so who is affected, is not stated.
What
An organization can give Claude Code a list of root certificates (the certificates that vouch for a server's identity) to trust when it connects through a gateway. Claude Code now checks that list more strictly:
- An entry only counts if its expiry date is in the future and no more than about a year past when Claude Code was built.
- A listed root certificate is skipped if it is a public one, is not allowed to vouch for other certificates, or uses a weak key.
- When only one root is trusted, the server's certificate must name the exact hostname in its list of names it is valid for.
Why
This makes it harder for a wrong or weak certificate to be trusted, and an entry that used to be accepted may now be skipped.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubt
Which gateway setups use this allowlist, and so who is affected, is not stated.