[BUG] Native Windows build fails with CERT_HAS_EXPIRED on clean direct connection; system Node validates the same chain fine; NODE_USE_SYSTEM_CA / NODE_EXTRA_CA_CERTS / BUN_CA_BUNDLE all ignored

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Native build on Windows fails at startup with CERT_HAS_EXPIRED connecting to platform.claude.com, on a clean direct connection (no proxy/VPN/TLS-inspection). System Node validates the exact same endpoint/chain fine.

What Should Happen?

claude should connect to Anthropic and start, the same way system Node successfully connects to platform.claude.com.

Error Messages/Logs

Welcome to Claude Code v2.1.193
..........................................................

     *                                       █████▓▓░
                                 *         ███▓░     ░░
            ░░░░░░                        ███▓░
    ░░░   ░░░░░░░░░░                      ███▓░
   ░░░░░░░░░░░░░░░░░░░    *                ██▓░░      ▓
                                             ░▓▓███▓▓░
 *                                 ░░░░
                                 ░░░░░░░░
                               ░░░░░░░░░░░░░░░░
       █████████                                        *
      ██▄█████▄██                        *
       █████████      *
.......█ █   █ █..........................................

 Unable to connect to Anthropic services

 Failed to connect to platform.claude.com: CERT_HAS_EXPIRED

 SSL certificate error (CERT_HAS_EXPIRED). If you are behind a corporate proxy or TLS-intercepting firewall, set
 NODE_EXTRA_CA_CERTS to your CA bundle path, or ask IT to allowlist *.anthropic.com. Run /doctor for details.

 See https://code.claude.com/docs/en/network-config

Steps to Reproduce

1. Windows, native install, no proxy 2. open PowerShell 3. run claude → 立刻 CERT_HAS_EXPIRED

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.187

Claude Code Version

2.1.193

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Environment is clean and verified:

• Direct connection, no proxy/VPN/TLS-inspection (netsh winhttp = direct; npm proxy = null)
• curl.exe to platform.claude.com works (schannel, Windows root store OK)
• System Node v24.16.0, STRICT verification:

node -e "require('https').get('https://platform.claude.com',...)" → OK 200

• Manual tls.connect chain dump — every cert [ok], none expired:

leaf ← YE1 ← Root YE ← ISRG Root X2 ← ISRG Root X1
(Let's Encrypt 2026 chain; X2 intermediate valid_from 2026-05-13, valid_to 2032)

• Same machine, same chain, claude startup → CERT_HAS_EXPIRED

Tried, ALL ignored by the native build:

• NODE_USE_SYSTEM_CA=1
• NODE_EXTRA_CA_CERTS (full bundle incl. ISRG Root X1 + X2)
• BUN_CA_BUNDLE (native build appears to be Bun-based per #24470/#43050)

Note: npm install of @anthropic-ai/claude-code also ships the same native
bin/claude.exe (the .cmd just calls bin\claude.exe), so it never runs system Node.
WSL2 Claude Code works fine. Looks like the bundled runtime's CA store can't
validate the 2026 Let's Encrypt chain and ignores all external CA overrides.