[BUG] Local MCP server will not trust self-signed certs

Status Closed — not planned

Maintainer reply None cached

Activity 8 comments · opened Jul 3, 2025 · closed Jan 21, 2026

Environment

Platform (select one):
[x] Anthropic API
[ ] AWS Bedrock
[ ] Google Vertex AI
[ ] Other:
Claude CLI version: 1.0.41
Operating System: Windows 11 (WSL 2)
Terminal: Windows Terminal

Bug Description

As Claude itself uncovered, Claude Code does not have a built-in option to ignore SSL certificate validation for self-signed certificates. Also, in my case these are Lando generate certs, that are generated by the Lando CA which is added to both my WSL instance and to Windows as a trusted CA -- so I'm not sure why Claude Code doesn't accept it. Also, the same local MCP server setup in VS Code works, so it feels like it should work out of the box.

Steps to Reproduce

Create a local self-signed cert (signed by a trusted local CA)
Add MCP server that uses this local certs, i.e. https://mysite.lndo.site

Expected Behavior

Claude Code should just trust the local self-signed cert and work as normal

Actual Behavior

You end up with a fetch failed error. Full debug info reveals:

MCP server "wordpress-mcp": HTTP Connection error: {"url":"https://mysite.lndo.site/wp-json/wp/v2/wpmcp/streamable","error":"fetch failed","stack":"TypeError: fetch failed at node:internal/deps/undici/undici:13510:13\n    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at async on1.send (file:///home/my-user/.nvm/versions/node/v22.16.0/lib/node_modules/@anthropic-ai/claude-code/cli.js:1342:24681)"}

Additional Context

You can get around this by using, (NODE_TLS_REJECT_UNAUTHORIZED=0 claude) to load Claude Code but that is obviously not desirable for various reasons, particularly security.

View original on GitHub ↗

8 Comments

github-actions[bot] · 1 year ago

Found 1 possible duplicate issue:

https://github.com/anthropics/claude-code/issues/2855

This issue will be automatically closed as a duplicate in 3 days.

If your issue is a duplicate, please close it and 👍 the existing issue instead
To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

jordan-burnett · 1 year ago

Also experiencing this. If the certificates were issued by mkcert you can also work around the issue by running

NODE_EXTRA_CA_CERTS=$(mkcert -CAROOT)/rootCA.pem claude

github-actions[bot] · 10 months ago

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

onetrev · 10 months ago

Hey, can anyone else confirm this is still happening? I'm guessing yes, but I don't have an active setup that is using self-signed certs right now. Please thumb up to let me know, so I know not to close this.

symdeb · 9 months ago

Claude does not have a Linux version. MCP inspector works with self signed certs, but Cursor, Warp, Windsurf and probably many others don't and Warp and Cursor don't give any clue why they fail. (in my case with a local streaming HTTP MCP authorization and MCP server). It appears self signed and/or localhost isn't handled well by many if not all MCP hosts. Perhaps these hosts use the same code base. it's really frustrating.
The error in Windsurf is"
failed to initialize server: failed to create client: failed to initialize SSE client: failed to start client: failed to connect to SSE stream: Get "https://localhost/api/mcp/mcp": tls: failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2025-12-20T21:29:05+08:00 is after 2024-10-16T11:19:49Z

github-actions[bot] · 8 months ago

This issue has been automatically closed due to 60 days of inactivity. If you're still experiencing this issue, please open a new issue with updated information.

symdeb · 8 months ago

Github cannot even count, Dec 20 isn't 60 days ago. This is how most companies and Anthropic closes bugs now, ignore and let them expire...