{"version":"2.1.315","anchor":"two-new-env-vars-disable-certificate-dropping-behaviour","canonical_anchor":"two-new-env-vars-disable-certificate-dropping-behaviour","heading":"Claude Code drops suspect CA certificates from NODE_EXTRA_CA_CERTS, with two opt-out switches and clearer errors","tier":"use","area":"Network Security","scope":"both","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.315\/e\/two-new-env-vars-disable-certificate-dropping-behaviour","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.315","markdown":"### Claude Code drops suspect CA certificates from NODE_EXTRA_CA_CERTS, with two opt-out switches and clearer errors\n\nUnverifiable self-named and looped cross-signed CA certificates are now dropped, two env vars keep them, and certificate errors explain missing issuers\n\n**Unclear.** Which certificates are dropped, and whether dropping happens by default, is not settled.\n\n**What**\n\nCA certificates tell Claude Code which secure connections to trust. Many companies add their own through the file named in `NODE_EXTRA_CA_CERTS`. Claude Code now filters that file more strictly, and adds ways to turn the filtering off:\n\n- A certificate that names itself as its own issuer is dropped unless its own key signed it, it is in Node's built-in root list, or it can otherwise be checked. Before, any such certificate was treated as trusted.\n\n- When one is dropped, Claude Code logs it as an error and prints a warning with the certificate's SHA-256 fingerprint, suggesting you run with `--debug` for details.\n\n- Setting `CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP=1` keeps every such certificate.\n\n- Looped cross-signed certificates (certificates that vouch for each other in a circle) are also pruned. `CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP` turns that off.\n\n- Both variables are listed with the other certificate settings such as `CLAUDE_CODE_CERT_STORE` and `NODE_EXTRA_CA_CERTS`. Changing either one in your settings re-runs certificate setup.\n\n- Certificate loading reports dropped self-named certificates separately.\n\nCertificate errors are also clearer. Before, three error codes shared one message, \"SSL certificate verification failed\", with a hint about `NODE_EXTRA_CA_CERTS`. Now:\n\n- `UNABLE_TO_GET_ISSUER_CERT` has its own message, saying the certificates this computer trusts include a CA certificate whose own issuer is missing.\n\n- `UNABLE_TO_VERIFY_LEAF_SIGNATURE` and `UNABLE_TO_GET_ISSUER_CERT_LOCALLY` now explain that the server sent an incomplete certificate chain.\n\n- The suggested fix depends on your situation: set `NODE_EXTRA_CA_CERTS`, or ask your IT team.\n\n**Why**\n\nIf you work behind a corporate proxy with a custom certificate bundle, some certificates may now be dropped after upgrading and connections can fail. The warning names the certificate, and the two variables restore the old behaviour if you trust it.\n\n- Area: Network Security\n- Tier: Use it now\n- Useful: 5\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: yes"}