[BUG] SELF_SIGNED_CERT_IN_CHAIN Error: Extension Fails in Corporate Proxy Environment (Zscaler)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The Claude VS Code extension (v2.1.39) is unusable on a Windows machine operating behind a standard corporate proxy (Zscaler) that performs SSL inspection. The extension's claude.exe process consistently fails to connect to its backend services, throwing a SELF_SIGNED_CERT_IN_CHAIN error. This occurs because the executable does not seem to respect any standard Windows mechanisms for trusting custom root certificates.

To Reproduce

Work on a Windows machine that routes all HTTPS traffic through a Zscaler (or similar) SSL-inspecting proxy.

Install the Claude VS Code extension.

Attempt to use any feature that requires a network connection (e.g., sending a message).

The action fails, and the logs show a SELF_SIGNED_CERT_IN_CHAIN error.

Expected behavior
The extension should either:

Respect the Windows Trusted Root Certificate store, where the corporate root CA is installed.

Respect standard environment variables (NODE_EXTRA_CA_CERTS or SSL_CERT_FILE) that point to the custom CA file.

Provide an extension-specific setting to define a path to a custom CA file.

Logs
The following error appears repeatedly in the VS Code Output panel for the Claude extension:

[ERROR] "Error: Error: 1P event logging: 8 events failed to export (code=SELF_SIGNED_CERT_IN_CHAIN, self signed certificate in certificate chain)\n at queueFailedEvents (B:/\~BUN/root/claude.exe:1909:2350)\n at async doExport (B:/\~BUN/root/claude.exe:1909:1257)\n at processTicksAndRejections (native:7:39)"
And is often preceded by a generic connection error:

[ERROR] "Error: Error: Connection error.\n at makeRequest (B:/\~BUN/root/claude.exe:355:4548)\n at processTicksAndRejections (native:7:39)"
Attempted Solutions (None have worked)
A comprehensive troubleshooting process was undertaken to resolve this issue from the client-side, all of which failed, pointing to an application-level issue:

Installed Corporate Root Certificate: The Zscaler Root CA has been correctly installed into the Local Machine -> Trusted Root Certification Authorities store in Windows. This is confirmed to work for all browsers and other system development tools.

Disabled http.proxyStrictSSL: Setting "http.proxyStrictSSL": false in VS Code's settings.json was ignored by claude.exe.

Set NODE_EXTRA_CA_CERTS: This system-wide environment variable was set to the full path of the Zscaler root certificate .cer file. After a full system restart, the error persisted.

Set SSL_CERT_FILE: As an alternative, this system-wide environment variable was also set to the full path of the Zscaler root certificate file. After a full system restart, the error persisted.

Conclusion
The claude.exe process appears to be using a self-contained networking stack (possibly from its Bun runtime) that is completely isolated from the host operating system's trust configuration. This makes the extension fundamentally incompatible with many standard corporate and enterprise security environments.

Request
Could you please implement a feature to allow the extension to trust a custom root certificate, either by respecting system settings or by providing a dedicated configuration option within the extension?

VScode extension: Claude COde for VS Code (Anthropic) Version 2.1.39

Thank you
_Michele_

What Should Happen?

For the extension to be usable in a corporate environment with SSL inspection, the claude.exe process should successfully trust the corporate root certificate and establish a connection without a SELF_SIGNED_CERT_IN_CHAIN error.

This should be achievable through one of the following standard mechanisms, listed in order of preference:

Honor the Operating System's Trust Store (Ideal Behavior): The application should automatically trust any certificate authorities that are installed in the host's native trust store (e.g., the "Trusted Root Certification Authorities" store on Windows). This is standard behavior for most network-aware applications and requires no special configuration from the user beyond installing the corporate certificate system-wide.

Respect Standard Environment Variables: If the OS trust store is not used, the application should check for and respect industry-standard environment variables used for this exact purpose. Specifically:

NODE_EXTRA_CA_CERTS

SSL_CERT_FILE
When either of these variables is set to the path of the corporate root CA file, the application should add it to its chain of trust.

Provide an Extension-Specific Setting (Fallback): As a last resort, if the above methods are not implemented, the extension should provide a dedicated setting in VS Code's settings.json to allow users to specify the path to a custom certificate authority file.

Error Messages/Logs

2026-02-11 10:57:57.112 [info] From claude: 2026-02-11T18:57:57.112Z [ERROR] "Error: Error: {\"message\":\"Failed to export 11 events (code=SELF_SIGNED_CERT_IN_CHAIN, self signed certificate in certificate chain)\",\"originalLine\":\"1909\",\"originalColumn\":\"1409\",\"line\":\"1909\",\"column\":\"1409\",\"sourceURL\":\"B:/~BUN/root/claude.exe\",\"stack\":\"Error: Failed to export 11 events (code=SELF_SIGNED_CERT_IN_CHAIN, self signed certificate in certificate chain)\\n    at doExport (B:/~BUN/root/claude.exe:1909:1409)\\n    at processTicksAndRejections (native:7:39)\",\"name\":\"Error\"}\n    at error (B:/~BUN/root/claude.exe:1952:25028)\n    at <anonymous> (B:/~BUN/root/claude.exe:1904:19992)\n    at Jv1 (B:/~BUN/root/claude.exe:1904:20536)\n    at <anonymous> (B:/~BUN/root/claude.exe:1905:17366)\n    at processTicksAndRejections (native:7:39)"

Steps to Reproduce

Work on a Windows machine that routes all HTTPS traffic through a Zscaler (or similar) SSL-inspecting proxy.

Install the Claude VS Code extension.

Attempt to use any feature that requires a network connection (e.g., sending a message).

The action fails, and the logs show a SELF_SIGNED_CERT_IN_CHAIN error.

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.39

Platform

Other

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_