{"version":"2.1.311","anchor":"ca-allowlist-refuses-when-runtime-has-no-bundled-roots","canonical_anchor":"ca-allowlist-refuses-when-runtime-has-no-bundled-roots","heading":"Certificate allowlist refuses every root when the runtime ships no root certificates","tier":"notice","area":"Network","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311\/e\/ca-allowlist-refuses-when-runtime-has-no-bundled-roots","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.311","markdown":"### Certificate allowlist refuses every root when the runtime ships no root certificates\n\nIf the runtime has no built-in root certificates, Claude Code now allowlists no root certificate authority and says why\n\n**What**\n\nClaude Code checks certificate authorities (the organisations that vouch for a website's security certificate) against an allowlist. That check now receives the list of root certificates built into the runtime Claude Code is running on. If that list is empty, Claude Code allowlists no root at all and reports: \"this runtime has no built-in root certificates, so Claude Code cannot tell a public CA from a private one and allowlists no root\". Before, there was no check for an empty list.\n\n**Why**\n\nWithout a built-in list, Claude Code has no way to tell a public certificate authority from a private one. Refusing every root is the safe outcome, and the message tells you why connections relying on that allowlist are not trusted.\n\n- Area: Network\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}