Claude Code drops suspect CA certificates from NODE_EXTRA_CA_CERTS, with two opt-out switches and clearer errors

What

CA certificates tell Claude Code which secure connections to trust. Many companies add their own through the file named in NODE_EXTRA_CA_CERTS. Claude Code now filters that file more strictly, and adds ways to turn the filtering off:

• A certificate that names itself as its own issuer is dropped unless its own key signed it, it is in Node's built-in root list, or it can otherwise be checked. Before, any such certificate was treated as trusted.
• When one is dropped, Claude Code logs it as an error and prints a warning with the certificate's SHA-256 fingerprint, suggesting you run with --debug for details.
• Setting CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP=1 keeps every such certificate.
• Looped cross-signed certificates (certificates that vouch for each other in a circle) are also pruned. CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP turns that off.
• Both variables are listed with the other certificate settings such as CLAUDE_CODE_CERT_STORE and NODE_EXTRA_CA_CERTS. Changing either one in your settings re-runs certificate setup.
• Certificate loading reports dropped self-named certificates separately.

Certificate errors are also clearer. Before, three error codes shared one message, "SSL certificate verification failed", with a hint about NODE_EXTRA_CA_CERTS. Now:

• UNABLE_TO_GET_ISSUER_CERT has its own message, saying the certificates this computer trusts include a CA certificate whose own issuer is missing.
• UNABLE_TO_VERIFY_LEAF_SIGNATURE and UNABLE_TO_GET_ISSUER_CERT_LOCALLY now explain that the server sent an incomplete certificate chain.
• The suggested fix depends on your situation: set NODE_EXTRA_CA_CERTS, or ask your IT team.

Why

If you work behind a corporate proxy with a custom certificate bundle, some certificates may now be dropped after upgrading and connections can fail. The warning names the certificate, and the two variables restore the old behaviour if you trust it.