[BUG] Setting NODE_EXTRA_CA_CERTS breaks claude code
Status Fixed / completed
Maintainer reply ✓ Yes — ant-kurt
Workaround ✓ Mentioned in thread ↓
Activity 10 comments · opened Jul 1, 2025 · closed Jul 2, 2025
💡 Likely answer: A maintainer (ant-kurt, collaborator)
responded on this thread — see the highlighted reply below.
Environment
- Platform (select one):
- [x] Anthropic API
- [ ] AWS Bedrock
- [ ] Google Vertex AI
- [ ] Other: <!-- specify -->
- Claude CLI version: 1.0.38
- Operating System: macOS
- Terminal: warp
Bug Description
On version 1.0.31 I could have NODE_EXTRA_CA_CERTS and claude would work. Now in 1.0.38 the CLI is unable to talk to claude if i have that set.
Steps to Reproduce
- set NODE_EXTRA_CA_CERTS to a valid cert on your
zshrcorbashrc - send hi to claud
Expected Behavior
Claude works
Actual Behavior
※ Tip: Did you know you can drag and drop image files into your terminal?
> hi
⎿ API Error (Connection error.) · Retrying in 1 seconds… (attempt 1/10)
⎿ TypeError (fetch failed)
⎿ API Error (Connection error.) · Retrying in 1 seconds… (attempt 2/10)
⎿ TypeError (fetch failed)
⎿ API Error (Connection error.) · Retrying in 2 seconds… (attempt 3/10)
⎿ TypeError (fetch failed)
10 Comments
I was having the same issue starting today.
In the debug output I saw "[DEBUG] mTLS: Created undici agent with custom certificates". I wonder if it was replacing the list of certificates instead of adding the NODE_EXTRA_CA_CERTS to the standard list in the system cert store.
Same issue. Basically not moving /working due to API errors
On Mon, Jun 30, 2025 at 10:01 PM Daniel Imfeld @.***>
wrote:
I have the same issue here with version
1.0.38. Please help!Uninstall and nuke all Claude related files and then reinstall! Worked
magic
On Mon, Jun 30, 2025 at 11:20 PM Yifan Sheng @.***>
wrote:
@swm-sink wdym by nuking all claude related files? have uninstalled it, but couldnt find any extra claude files, after reinstalling still didnt work
Downgrading works for us as did removing NODE_EXTRA_CA_CERTS. It seems like NODE_EXTRA_CA_CERTS may be being sent to the Undici agent instead of the default cert store and NODE_EXTRA_CA_CERTS.
Our NODE_EXTRA_CA_CERTS contains some internal self-signed certs which I'm assuming is resulting in TLS failures since the endpoint cert is not signed by that internal CA. Removing it works which would indicate that we're not actually extending the default CA store with the additional certs
This was my case as well.
For anyone still having trouble, you can work around for now by unsetting that variable in your environment or run Claude with
NODE_EXTRA_CA_CERTS= claude(Note the space after the equals sign).This should be resolved in
1.0.40Related to #2816
Looks like 1.0.40 is released. Confirmed that it works now. Thanks!
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.