[BUG] SSL certificate configuration don't work with web page `Fetch` (but works with MCP)

Status Open

Maintainer reply None cached

Activity 5 comments · opened Jul 21, 2025

Environment

Platform (select one):
[ ] Anthropic API
[x] AWS Bedrock
[ ] Google Vertex AI
[ ] Other:
Claude CLI version: 1.0.56 (Claude Code)
Operating System: Mac OS 15.5
Terminal: Terminal.app

Bug Description

Despite having SSL_CERT_FILE and NODE_EXTRA_CA_CERTS configuration (as suggested here), Claude Code fails to fetch web pages.

Steps to Reproduce

Set up PC with a company's network tool that intercepts HTTPS/TLS (at the OS layer) but is NOT a proxy
Configure SSL_CERT_FILE and NODE_EXTRA_CA_CERTS in ~/.claude/settings.json (do NOT set HTTPS_PROXY because the network tool is not a proxy)
Have Claude Code fetch any web page
Choose yes for the Do you want to proceed?

Expected Behavior

Claude Code should be able to fetch web pages.

Actual Behavior

Claude Code displays the error message: Error: Domain yahoo.co.jp is not allowed to be fetched.

Additional Context

Even under the same configuration and setup, remote MCP works well despite also using HTTPS communication
If I temporarily turn off the company's network interception tool, web page fetching works correctly
When I ask Claude Code to show environment variables, it correctly displays the variables I set:

> Please show your environment variable value of SSL_CERT_FILE and NODE_EXTRA_CA_CERTS

⏺ Bash(echo "SSL_CERT_FILE: $SSL_CERT_FILE" && echo "NODE_EXTRA_CA_CERTS: $NODE_EXTRA_CA_CERTS")
  ⎿  SSL_CERT_FILE: /Users/s-yazaki/ZscalerRootCA.pem
     NODE_EXTRA_CA_CERTS: /Users/s-yazaki/ZscalerRootCA.pem

⏺ Both SSL_CERT_FILE and NODE_EXTRA_CA_CERTS are set to /Users/s-yazaki/ZscalerRootCA.pem, indicating you're using Zscaler's corporate proxy with custom CA certificates.

Even under the same configuration and setup (with the company's tool enabled), using curl through Claude Code works correctly

> Can you try `curl` on that page? It likely works

⏺ Bash(curl -s https://yahoo.co.jp | head -20)
  ⎿  (No content)

⏺ Bash(curl -I https://yahoo.co.jp)
  ⎿  HTTP/1.1 301 Redirect
     Date: Mon, 21 Jul 2025 04:34:17 GMT
     Connection: close
     … +11 lines (ctrl+r to expand)

(snip)

⏺ Yes, curl works fine! The page loads successfully through the corporate proxy. The issue is that the WebFetch tool has domain restrictions that prevent it from accessing yahoo.co.jp, even though the network connection works properly through curl with the Zscaler certificates.

View original on GitHub ↗

5 Comments

johnpangalos · 1 year ago

Seems to be a node issue as when I just tried using fetch with node it didn't work. Setting this environment variable seems to fix the issue though:

export NODE_OPTIONS="--use-system-ca"

It's relatively new so you might have to upgrade your version of node. Latest LTS supports this flag.

saiya · 1 year ago

Thank you for sharing, NODE_OPTIONS (with the latest LTS node.js & re-install claude npm package) worked well as workaround.

Through the inconsistency between MCP and WebFetch looks a bug (and cause some inconvenience on company network setup), thus I would like to keep this issue opened and hoping Anthorpics fixes it at some moment...

kisnandor2 · 8 months ago

I can confirm! On company network the Fetch was failing. Disabling the VPN was until now my only way to solve it (or force use curl). Using NODE_OPTIONS does the trick. Huge thanks @johnpangalos 🤗

github-actions[bot] · 7 months ago

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

randybirdsall · 7 months ago

This issue is still problematic for our enterprise Claude Code users and causing friction for it's adoption. Is there a native solution in the roadmap that doesn't require the workarounds?