Certificate handling keeps cross-certificates a server's chain needs, with an opt-out

What

Claude Code connects to the internet over HTTPS, which relies on certificates. Root certificates (CAs) are the trusted starting points, and cross-certificates link one root to another. Some cross-certificates form loops beside a matching root. Before, Claude Code dropped all of these. Now it records the certificates a server sends during a connection and keeps the looping cross-certificates that server's chain needs. The certificates the server sends are used only to choose which system cross-certificates stay. They are not added to the list of trusted roots.

• CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP=1 turns the dropping off and keeps every looping cross-certificate.
• A cache now remembers certificates already read, so Claude Code does not parse the same one twice.
• Bundled roots and the system's own certificate store are now read through one shared helper.
• The check for roots that name themselves now compares certificates directly, and it has a shortcut for when nothing needs dropping.
• The HTTPS connection pool no longer closes open connections when the set of certificates changes. A separate kind of connection pool is used when connections are set to close after a server error.

Why

This matters most behind corporate proxies that inspect HTTPS traffic, or in companies with their own certificates. Removing a cross-certificate a server's chain depends on can make connections fail. Keeping the ones a chain needs avoids that, and the environment variable gives you a way out if the pruning still causes trouble.