[BUG] mTLS client certificates broken in v2.1.23+ (works in v2.1.22)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

• Platform: Anthropic API
• Claude CLI version: 2.1.25 (broken), 2.1.22 (works)
• Operating System: Ubuntu
• Terminal: Bash

Bug Description

Claude Code fails to connect to the API with FailedToOpenSocket error starting in version 2.1.23. Version 2.1.22 works correctly with the same environment and configuration.

I'm behind corporate SSL inspection and use mTLS (mutual TLS) client certificates. My environment has:

• CLAUDE_CODE_CLIENT_CERT set for mTLS client certificate
• SSL_CERT_FILE set to custom CA bundle
• NODE_EXTRA_CA_CERTS set to the same CA bundle
• CURL_CA_BUNDLE set (curl works fine)

The debug log shows the certificates are being loaded:

[DEBUG] mTLS: Loaded client certificate from CLAUDE_CODE_CLIENT_CERT
[DEBUG] NODE_EXTRA_CA_CERTS detected - Node.js will automatically append to built-in CAs
[DEBUG] mTLS: Creating HTTPS agent with custom certificates

But all API requests fail with connection errors:

[ERROR] API error (attempt 1/11): undefined Connection error.
[ERROR] Connection error details: code=FailedToOpenSocket, message=Was there a typo in the url or port?

What Should Happen?

Claude Code should connect to the API using the configured certificates, as it does in version 2.1.22.

Error Messages/Logs

Steps to Reproduce

Steps to Reproduce

1. Configure corporate SSL inspection environment with custom CA certificates
2. Set CLAUDE_CODE_CLIENT_CERT, SSL_CERT_FILE, and NODE_EXTRA_CA_CERTS
3. Install Claude Code 2.1.23 or later via native binary installer
4. Run claude
5. Attempt any operation

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.22

Claude Code Version

2.1.25

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

Other

Additional Information

Additional Context

• curl works correctly when CURL_CA_BUNDLE is set
• The issue appears to be specific to how Bun handles TLS/SSL certificates in the native binary
• Setting CLAUDE_CODE_PROXY_RESOLVES_HOSTS=true does not resolve the issue
• This may be related to other certificate-handling issues: #20194, #4053, #2899

<details>
<summary>Debug log excerpt</summary>

2026-01-30T14:06:50.738Z [DEBUG] [init] configureGlobalMTLS starting
2026-01-30T14:06:50.738Z [DEBUG] mTLS: Loaded client certificate from CLAUDE_CODE_CLIENT_CERT
2026-01-30T14:06:50.738Z [DEBUG] NODE_EXTRA_CA_CERTS detected - Node.js will automatically append to built-in CAs
2026-01-30T14:06:50.738Z [DEBUG] [init] configureGlobalMTLS complete
2026-01-30T14:06:50.738Z [DEBUG] [init] configureGlobalAgents starting
2026-01-30T14:06:50.738Z [DEBUG] mTLS: Creating HTTPS agent with custom certificates
2026-01-30T14:06:50.738Z [DEBUG] [init] configureGlobalAgents complete
...
2026-01-30T14:06:52.671Z [ERROR] API error (attempt 1/11): undefined Connection error.
...
2026-01-30T14:09:45.408Z [ERROR] Connection error details: code=FailedToOpenSocket, message=Was there a typo in the url or port?

</details>