[BUG] Native Claude Code not using system certs on MacOS
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
Recently updated to the native installer after seeing the deprecation message, and started experiencing Claude Code hanging up with the message API Error: Error: unable to get issuer certificate, with a similar error trying to run the native installer.
Eventually I discovered that this was because my company is using Netskope to proxy all https traffic:
% curl -vI https://storage.googleapis.com/ 2>&1 | grep -A 6 "Server certificate"
* Server certificate:
* subject: CN=storage.googleapis.com
* start date: Dec 10 22:13:51 2025 GMT
* expire date: Jan 9 22:13:51 2027 GMT
* subjectAltName: host "storage.googleapis.com" matched cert's "storage.googleapis.com"
* issuer: emailAddress=certadmin@netskope.com; CN=ca.amperity.goskope.com; OU=<>; O=Amperity; L=Seattle; ST=WA; C=US
* SSL certificate verify ok.Netskope adds a certificate to the MacOS root chain but this isn't being respected by CC. The docs mention an environment variable but it doesn't work - looks like from the pre-native era? Currently I can disable the Netskope client and still use CC but this isn't ideal.
What Should Happen?
Claude should use the system certificate chain for verification
Error Messages/Logs
% /Users/ras/.claude/downloads/claude-2.1.17-darwin-arm64 install
✘ Installation failed
Failed to fetch version from https://storage.googleapis.com/claude-code-dist-86c565f3-f756-42ad-8dfa-d59b1c
096819/claude-code-releases/latest: self signed certificate in certificate chainSteps to Reproduce
- Install a MITM proxy for https traffic
- Try to use the native Claude Code
Claude Model
None
Is this a regression?
Yes, this worked in a previous version
Last Working Version
2.1.16
Claude Code Version
2.1.17
Platform
AWS Bedrock
Operating System
macOS
Terminal/Shell
Other
Additional Information
_No response_
Showing cached comments. Read the full discussion on GitHub ↗
12 Comments
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
I think this can be solved on our side by whitelisting with Netskope but the docs could still be updated for the new native build
Same issue here in WSL with a corporate MITM gateway. Gateway certs are installed and current in WSL and work fine with all services except Claude Code native. Same steps to reproduce as @ristew-amperity gives.
Error Messages/Logs
(--force has no effect)
Last Working Version
Latest from npm. No Claude Code native version works.
Our company is impacted, we get
Error: self signed certificate in certificate chain.when trying to auth the Notion MCP with our VPN on.I ran a little experiment just making requests to Notion from my laptop with the VPN on. cURL worked, node.js worked, Bun made the self-signed certificate error.
I think I am having a similar issue when running on Windows Terminal (PowerShell). Maybe I am wrong here, but I think we need the ability to pass our MITM certs during install?
FWIW: I found following workaround from https://github.com/anthropics/claude-code/issues/8054#issuecomment-3324293239
Confirmed this is an issue for all versions of Claude Code Native and NPM deployments. None tested on Windows, Linux, or MacOS utilize installed certificates in the OS for SSL proxies.
NPM deployments can work around with NODE_TLS_REJECT_UNAUTHORIZED=0, but native Claude Code has no such option and so cannot reach the API to handle prompts.
This is an issue on Windows environments as well. I had to set environment variable NODE_USE_SYSTEM_CA=1, just to get Claude to install successfully. Note, we're using Zscaler proxy.
Same here with Cloudflare WARP:
NODE_EXTRA_CA_CERTS="/path/to/your/cert.pem"See also: #22559.
This issue is painful and kind of annoying in my corporate environment. I would love to see some progress on this so I don't have to do hacky work arounds and upset my security team :)
I had to bypass our Zscaler proxy to make it work :
env -u HTTP_PROXY -u http_proxy -u HTTPS_PROXY -u https_proxy bash ./install.sh