{"version":"2.1.311","anchor":"agent-proxy-can-install-the-ca-directly-into-the-java-cacert","canonical_anchor":"agent-proxy-can-install-the-ca-directly-into-the-java-cacert","heading":"Agent proxy can add its certificate directly to the Java trust store","tier":"notice","area":"Cloud Sessions","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311\/e\/agent-proxy-can-install-the-ca-directly-into-the-java-cacert","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311","markdown":"### Agent proxy can add its certificate directly to the Java trust store\n\nWhen setting up trust for Java, the agent proxy now adds its CA straight into the Java cacerts store and skips the hook if that works\n\n**What**\n\nThe agent proxy sits between Claude Code's tools and the network. It uses its own CA (certificate authority, the certificate that tells programs to trust its secure connections), and it installs that CA through an install hook. When the hook in question is the Java one, the proxy now first tries to add the CA directly to Java's `cacerts` store (the list of certificates Java programs trust).\n\n- If the direct install works, the hook is not run. Before, the hook always ran.\n\n- The result is returned as `javaStore`.\n\n- The proxy's report on how trust was set up now includes `java_store` and `second_anchor_java_store` when a Java trust store was involved. Before, it held only whether a CA was reused and which method was used.\n\n**Why**\n\nThis changes how secure connections get trusted for Java tools that run through the proxy. If Java tools had trouble trusting the proxy, the CA may now be in the Java store without the hook running.\n\n- Area: Cloud Sessions\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}