You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
NetworkArea: what it touches
ImprovementsKind: in v2.1.311,
ImprovementsSection of the release
What
Claude Code checks certificate authorities (the organisations that vouch for a website's security certificate) against an allowlist. That check now receives the list of root certificates built into the runtime Claude Code is running on. If that list is empty, Claude Code allowlists no root at all and reports: "this runtime has no built-in root certificates, so Claude Code cannot tell a public CA from a private one and allowlists no root". Before, there was no check for an empty list.
Why
Without a built-in list, Claude Code has no way to tell a public certificate authority from a private one. Refusing every root is the safe outcome, and the message tells you why connections relying on that allowlist are not trusted.
