Extra CA certificate files with blocked or damaged certificates are handled more carefully

What

NODE_EXTRA_CA_CERTS is an environment variable, a setting passed to a program when it starts. It points Claude Code at a file of extra CA certificates to trust. CA certificates are what let Claude Code check that a secure connection is genuine, and company networks often need extra ones. Claude Code refuses certificates that are on its deny list.

• When the file holds a blocked certificate outside any certificate block, Claude Code now keeps the certificates it can read in full, re-encoded, instead of ignoring the whole entry. Before, the entry was dropped with a note that it still contained a blocked certificate.
• Claude Code now keeps two separate trust lists, one for Anthropic hosts and one for customer hosts. Certificates in a TRUSTED CERTIFICATE block are left out of the customer list.
• A new warning reports certificates that cannot be read.
• A second new warning says Claude Code used only the plain certificates it could read in full. It appears when the file holds a damaged copy of a root certificate on the deny list, such as one missing its END line.
• The certificate loader no longer logs the message about dropped certificates that do not chain to a root in the CA list. Instead it hands back the certificate list, a count of dropped certificates and details of where they came from, for other code to deal with.

Why

One damaged or blocked certificate in a company certificate bundle no longer throws away trust in all the others, and the new warnings say why something was left out. The message about dropped certificates may now appear somewhere else or in a different form.