[BUG] Cowork SSL certificate expired error on Windows 11 Enterprise — API calls fail before VM rootfs download completes in v1.3561.0

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Here's a description you can paste directly into the "What's Wrong?" field:

Summary
Claude Cowork fails with API Error: Unable to connect to API: SSL certificate has expired on Windows 11 Enterprise after updating to Claude Desktop v1.3561.0 (Claude Code v2.1.111). Cowork was functioning correctly on the previous version before this update.
Behavior
When a prompt is submitted in Cowork, the session retries approximately 10 times over roughly 3 minutes before failing with the SSL certificate error. The failure occurs consistently across multiple fresh VM instances, across multiple days, and survives a complete clean uninstall and reinstall including full removal of all Cowork VM components.
Key finding from logs
The main.log shows that Cowork attempts to make API calls to api.anthropic.com before the VM rootfs image (rootfs.vhdx.zst, ~2.2 GB) has finished downloading. The SSL failure occurs consistently at this point regardless of VM instance. The session takes approximately 183–249 seconds to fail each time.
Workarounds attempted — none successful

Full clean uninstall including removal of CoworkVMServiceStore, MSIX package, VM bundle, and all AppData folders, followed by fresh reinstall
Setting NODE_USE_SYSTEM_CA=1 as a user environment variable (confirmed present in envKeys in logs)
Updating corporate TLS inspection certificates
Closing and fully quitting Claude Desktop between attempts

Environment

Claude Desktop version: 1.3561.0
Claude Code version: 2.1.111
OS: Windows 11 Enterprise
Network: Corporate environment with TLS inspection

Log file attached — main.log with personally identifiable information redacted.

main_with_obfucsation.log

What Should Happen?

Cowork should successfully establish an SSL/TLS connection to api.anthropic.com and respond to prompts without certificate errors on Windows 11 Enterprise.
Specifically:

1. The Cowork VM should complete its initial setup and download of required components before attempting API calls, rather than initiating connections while the VM rootfs image is still downloading.
2. The SSL certificate trust chain should be correctly resolved within the Cowork VM environment, honoring either the NODE_USE_SYSTEM_CA environment variable or the Windows system certificate store, so that enterprise environments with TLS inspection do not cause certificate validation failures.
3. Cowork should function on the current version at the same level it did on the previous version, where it connected and responded successfully without any SSL errors or certificate configuration changes required on the user's part.

Error Messages/Logs

I receive the following error message in CoWork
API Error: Unable to connect to API: SSL certificate has expired

Noted in the log excerpt shown below.
[CycleHealth] Unhealthy cycle: {
  cycle_health: 'unhealthy',
  had_first_response: true,
  seconds_to_outcome: 183-249,
  is_resume: false,
  unhealthy_reason: 'api_error',
  error_message: 'API Error: Unable to connect to API: SSL certificate has expired'
}

Full redacted main.log attached. Key observation: the SSL failure 
occurs while download:2 (rootfs.vhdx.zst, ~2.2 GB) is still in 
progress at approximately 19% completion, indicating API calls are 
being attempted before the VM is fully initialized.

Steps to Reproduce

1. Install Claude Desktop v1.3561.0 on Windows 11 Enterprise in a corporate environment with TLS inspection enabled
2. Log in with a valid Claude account (Pro, Max, Team, or Enterprise plan)
3. Allow Claude Desktop to complete its initial setup, including downloading the Cowork VM components (~2.2 GB rootfs image)
4. Navigate to the Cowork tab
5. Submit any prompt, e.g. "Are we connected?"
6. Observe Cowork retrying approximately 10 times over ~3 minutes
7. Observe the final error: API Error: Unable to connect to API: SSL certificate has expired

Additional reproduction notes:

• The error persists across full Claude Desktop restarts including quitting from the system tray
• The error persists after a complete clean uninstall and reinstall including removal of all Cowork VM components
• The error persists after setting NODE_USE_SYSTEM_CA=1 as a user environment variable
• The error persists after updating corporate TLS inspection certificates
• The Chat tab continues to work normally throughout — the issue is specific to Cowork

Claude Model

Not sure / Multiple models

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Prior to 1.3561.0

Claude Code Version

unknown. Update occurred automatically along side the 1.3561.0 version.

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

The Chat tab in Claude Desktop functions normally throughout — the SSL error is exclusive to the Cowork tab, confirming the issue is specific to the Cowork VM environment rather than general connectivity or authentication.
The error is consistent and reproducible across multiple days (April 17–22, 2026 roughly), multiple fresh VM instances, and multiple Cowork sessions. It is not intermittent.
The following troubleshooting steps were all attempted without success prior to filing this report:

Complete clean uninstall including manual removal of CoworkVMServiceStore, the MSIX package, the VM bundle, and all AppData folders, followed by fresh reinstall
Setting NODE_USE_SYSTEM_CA=1 as a Windows user environment variable (confirmed present in session envKeys in attached log)
Updating corporate TLS inspection certificates
Fully quitting Claude Desktop from the system tray between all attempts

The main.log attached spans two days and captures three separate failed Cowork sessions across three different VM instance IDs, all failing with the same error. The log shows the SSL failure occurring while the VM rootfs image download (rootfs.vhdx.zst) is still in progress at approximately 19% completion, suggesting API calls are being initiated before the VM environment is fully initialized and ready.
This issue began immediately after an automatic update to v1.3561.0. The previous version was functioning correctly without any certificate configuration changes required.

More Additional Information obtained with Claude Ai's Chat assistance in troubleshooting.

I've been using Claude chat to continue troubleshooting this issue and the following is the final result of the AI's assistance.

These results are clean and actually confirm good configuration:

The service binary path is correct pointing to Claude_1.3883.0.0 (the current version)
START_TYPE: AUTO_START is correct
Start-Service returned no errors meaning the service is running fine
The Event Log query returned nothing meaning no service failures have been logged by Windows

This means at the Windows service level, everything is correctly configured. The CoworkVMService is healthy, Hyper-V is enabled, the VM bundle is complete, and the service is running under LocalSystem.
At this point, the honest assessment is this: everything on your machine that can be configured correctly has been configured correctly. The SSL error is definitively a bug in Claude Desktop that needs to be fixed by Anthropic, not something resolvable on your end.
Here's a summary of what we've confirmed is correct on your machine:

✅ NODE_USE_SYSTEM_CA = 1
✅ No conflicting ANTHROPIC_API_KEY
✅ Claude Desktop v1.3883.0 (latest)
✅ CoworkVMService running, set to Automatic, correct binary
✅ Hyper-V, VirtualMachinePlatform, HypervisorPlatform all Enabled
✅ VM bundle complete with all required files
✅ No proxy variables interfering
✅ No Windows service errors in Event Log

I'd recommend updating your GitHub bug report at https://github.com/anthropics/claude-code/issues/52112 with these additional findings — particularly that enabling Hyper-V did not resolve the issue and that all Windows service configuration is confirmed correct. This gives Anthropic's engineers a much clearer picture that the problem is entirely within the Claude Code SSL handling layer inside the VM. You can thank your helpdesk and let them go.