{"version":"2.1.317","anchor":"ca-cert-handling-cache-of-known-roots-and-served-certificat","canonical_anchor":"ca-cert-handling-cache-of-known-roots-and-served-certificat","heading":"Certificate handling keeps cross-certificates a server's chain needs, with an opt-out","tier":"notice","area":"Network","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317\/e\/ca-cert-handling-cache-of-known-roots-and-served-certificat","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.317","markdown":"### Certificate handling keeps cross-certificates a server's chain needs, with an opt-out\n\nClaude Code now keeps system cross-certificates a server's certificate chain needs instead of dropping every looping one, and adds an opt-out\n\n**Unclear.** It is not settled exactly what setting `CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP` switches off.\n\n**What**\n\nClaude Code connects to the internet over HTTPS, which relies on certificates. Root certificates (CAs) are the trusted starting points, and cross-certificates link one root to another. Some cross-certificates form loops beside a matching root. Before, Claude Code dropped all of these. Now it records the certificates a server sends during a connection and keeps the looping cross-certificates that server's chain needs. The certificates the server sends are used only to choose which system cross-certificates stay. They are not added to the list of trusted roots.\n\n- `CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP=1` turns the dropping off and keeps every looping cross-certificate.\n\n- A cache now remembers certificates already read, so Claude Code does not parse the same one twice.\n\n- Bundled roots and the system's own certificate store are now read through one shared helper.\n\n- The check for roots that name themselves now compares certificates directly, and it has a shortcut for when nothing needs dropping.\n\n- The HTTPS connection pool no longer closes open connections when the set of certificates changes. A separate kind of connection pool is used when connections are set to close after a server error.\n\n**Why**\n\nThis matters most behind corporate proxies that inspect HTTPS traffic, or in companies with their own certificates. Removing a cross-certificate a server's chain depends on can make connections fail. Keeping the ones a chain needs avoids that, and the environment variable gives you a way out if the pruning still causes trouble.\n\n- Area: Network\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: both\n- Heads-up: no"}