{"version":"2.1.323","anchor":"ca-chain-read-works-through-https-proxies","canonical_anchor":"ca-chain-read-works-through-https-proxies","heading":"Clearer certificate errors for cross-certificate chains and proxies","tier":"notice","area":"Certificates","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323\/e\/ca-chain-read-works-through-https-proxies","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.323","markdown":"### Clearer certificate errors for cross-certificate chains and proxies\n\nTLS certificate failures get code-specific messages, cross-certificate checks, and certificate-chain reads that now work through https:\/\/ proxies\n\n**What**\n\nTLS is the encryption behind secure connections, and it relies on a chain of certificates leading to a trusted authority. On company networks a proxy or firewall often breaks that chain. Several changes help Claude Code explain what went wrong.\n\n- Code-specific messages: for some SSL error codes, the error is now a hint for that code. Other codes keep the general advice to set `NODE_EXTRA_CA_CERTS` to your CA bundle path if you are behind a corporate proxy or TLS-intercepting firewall.\n\n- Missing root: on `UNABLE_TO_GET_ISSUER_CERT_LOCALLY`, when the chain runs through a cross-certificate in your computer's certificate store, a new message tells you to add the root certificate or have the proxy send the cross-certificate. A cross-certificate is a certificate that links one authority to another.\n\n- Unsigned cross-certificates: cross-certificates that loop in the system store are checked for whether a certificate in the store signed their issuer, and those that were not are reported as unsigned. If the check fails, it is logged and the issuer is treated as present.\n\n- Proxies: reading the server's certificate chain now works through `https:\/\/` proxies and verifies the proxy's own certificate. The advice says to set `https_proxy`, which is read first, to a complete `http:\/\/` or `https:\/\/` URL. Fetching managed settings retries after the chain is restored.\n\n- Wording: the guidance about PEM files (a common certificate file format) in the `NODE_EXTRA_CA_CERTS` warnings was reworded.\n\n**Why**\n\nCertificate errors behind corporate proxies are hard to diagnose from a generic message. These changes point more directly at the missing piece, whether that is a root certificate, a cross-certificate, or the proxy setup.\n\n- Area: Certificates\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: both\n- Heads-up: no"}