Self-signed certificate in certificate chain
A TLS-inspecting proxy presented a certificate Node will not trust.
41 issues · 6 open · 35 resolved (85%) · first seen Jul 3, 2025
First response · network
What to do now
Most likely: A DNS, proxy, TLS or socket layer interrupted the connection.
- Check whether the same request works without the current VPN or corporate proxy.
- Verify DNS and certificate trust without disabling TLS verification.
- Capture the hostname and exact socket code before escalating.
These are conservative triage steps, not an official Anthropic fix. Use the issue and workaround evidence below before making a destructive configuration change.
Is this getting better or worse?
This class of problem is converging. 8 new reports in the last 90 days vs 15 in the 90 before — -47%. The open backlog peaked at 7 in 2026-03 and sits at 6 today.
Derived by counting each matching issue from its creation date until it closed. First-party
computation over the anthropics/claude-code tracker — the trend is not published
anywhere upstream.
Which builds report this
23 of these reports name the Claude Code build they were running, spanning 22 releases. Heaviest reporters:
- Claude Code v2.0.76
- Claude Code v2.1.251
- Claude Code v2.1.226
- Claude Code v2.1.201
- Claude Code v2.1.178
- Claude Code v2.1.119
- Claude Code v2.1.136
- Claude Code v2.1.117
Report volume, not a defect count: an issue can mention a build without that build having caused the failure. Versions come from the version string in the bug-report template, matched against real published tags.
Do these get fixed?
Median time to close is 9 days across 35 closures. Of the 35 closures with a recorded reason, 23% were closed as completed and 27 as not-planned or duplicate. The most recent completed fix landed in 2026-08.
Workarounds reported by the community
20 of these issues post a workaround someone says worked. The highest-engagement ones:
- [BUG] Native Claude Code not using system certs on MacOS
- FWIW: I found following workaround from
Found in the thread of #20194 · resolved - [BUG] Claude Cowork — "Self-signed certificate detected" on macOS with no proxy
- …include coreutils (or at least wc) in the VM image. Found a workaround, posting below.
Found in the thread of #24470 · resolved - Claude Not Reading Claude.md
- …ing - "MUST/ALWAYS" directives are treated as suggestions - Workarounds are proposed even when explicitly forbidden - Only after 5-9 user corrections does Claude finally follow the intended procedure --- Documented Sessi…
Found in the description of #17530 · resolved - WebFetch tool fails with SSL error behind Zscaler/corporate proxy (Bun runtime ignores NODE_EXTRA_CA_CERTS)
- …aywright browser tool Works (uses Chromium/system keychain) Workaround Setting in the environment tells Bun to load certificates from the macOS system keychain (where the Zscaler root CA is already installed), bypassing…
Found in the description of #25977 · resolved - [Bug] Claude in Chrome WebSocket bridge fails behind Zscaler/corporate TLS proxy (unable to get local issuer certificate)
- …. "Control Chrome" MCP still works, so users have a partial workaround for basic browser automation, but the full "Claude in Chrome" side-panel experience is broken.
Found in the description of #31206 · resolved
Excerpts are quoted from the linked issue so you can judge relevance before opening it. Threads that only ask for a workaround, or report that there is none, are excluded. These are community suggestions, not official guidance from Anthropic — read the full thread before applying one.
Matching issues 1–41
Ranked by community engagement (reactions weighted over comments).
- [BUG] Native Claude Code not using system certs on MacOS
- [BUG] Claude Cowork — "Self-signed certificate detected" on macOS with no proxy
- [BUG] Local MCP server will not trust self-signed certs
- [Bug] Session token limit reached prematurely after upgrade to v2.0.64
- [BUG] NODE_EXTRA_CA_CERTS is not effective when set in ~/.claude/settings.json
- Claude Not Reading Claude.md
- WebFetch tool fails with SSL error behind Zscaler/corporate proxy (Bun runtime ignores NODE_EXTRA_CA_CERTS)
- [BUG] Cloud scheduled tasks: gRPC/HTTP2 blocked by sandbox TLS proxy to googleapis.com
- [Bug] Claude in Chrome WebSocket bridge fails behind Zscaler/corporate TLS proxy (unable to get local issuer certificate)
- Claude Desktop Code tab ignores NODE_EXTRA_CA_CERTS on Windows MSIX install behind corporate SSL proxy
- [BUG] Hosted MCP OAuth initiation ignores NODE_EXTRA_CA_CERTS on corporate MITM networks (v2.1.113+)
- [BUG] SELF_SIGNED_CERT_IN_CHAIN Error: Extension Fails in Corporate Proxy Environment (Zscaler)
- [FEATURE] Support TLS/SSL configuration for HTTP MCP servers
- [BUG] running 'claude install' no longer works w/ system cert store
- [BUG] Claude code seems to set proxy for commands in the "excludedCommands" sandbox settings
- [BUG] Failures with `SELF_SIGNED_CERT_IN_CHAIN` errors
- Remote Control silently fails when HTTPS-scanning AV (e.g. Norton 360) intercepts TLS - Node rejects MITM cert chain
- [BUG] Sandbox blocks OCSP/CRL certificate validation traffic, breaking HTTPS for allowed domains
- [BUG] Remote Control SSE channel (worker/events/stream) ignores NODE_EXTRA_CA_CERTS while the API channel honors it — same process, v2.1.201 (it's Node, not Bun)
- [BUG] 2.1.181 native installer fails with "unable to get local issuer certificate" when system cert store is forced (regression of #51889)
- [Bug] Claude Code not executable from terminal
- [BUG] Fail to Fetch Latest Release from Install Script
- [Feature Request] Expose active skill/plugin in statusline stdin JSON
- [BUG] OAuth browser does not open for HTTP MCP servers on Windows
- [Bug] Tool execution stuck in infinite loop with no output from bash command
- [BUG] Cowork Windows: NAT subnet mismatch + missing IP forwarding + no DNS on VM adapter
- NODE_EXTRA_CA_CERTS Environment variable not working
- Claude Cowork: SSL error — "ln not found" prevents ephemeral CA certificate from installing in VM
- [BUG] Claude Desktop Mac App - Code pane does not respect NODE_EXTRA_CA_CERTS behind corporate proxy
- [BUG] Installing Claude Code unable to get local issuer certificate
- [BUG] Code tab fails with SSL error: desktop app does not forward NODE_EXTRA_CA_CERTS to CLI subprocess
- [Bug] UTF-8 byte boundary panic with multibyte characters in filenames
- WebFetch doesn't respect system certificate trust store in environments with TLS inspection
- [BUG] API Error: Unable to connect to API: Self-signed certificate detected.
- [BUG] Claude Desktop Extension wrapper filters env vars — blocks Custom CA configuration for enterprise integrations (Instana / SwissSign / mcp-instana 0.3.1)
- [Feature Request] Restore Coding Buddy functionality
- [Feature Request] Add persona-based role system with shared and persona-specific knowledge/skills
- Claude desktop app hangs indefinitely on Exit/Restart — process never terminates after completing full quit-cleanup sequence
- Interactive TUI requires direct api.anthropic.com reachability, ignoring ANTHROPIC_BASE_URL (2.1.251)
- claude mcp login fails with 'unable to get local issuer certificate' against standard, non-intercepted certs
- [FEATURE] Browser pane: no way to bypass certificate errors for local development hosts (self-signed certs)