[BUG]Claude CLI hangs 60s at startup due to stale OCSP URL in api.anthropic.com TLS certificate

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

The TLS certificate for api.anthropic.com contains an OCSP responder URL (http://o.pki.goog/s/we1/HRE) that returns HTTP 404. On macOS, SecTrustEvaluateWithError is called synchronously at Claude CLI startup with no timeout guard. When the OCSP fetch fails, macOS retries and waits for the full system timeout (~60s per attempt, up to ~2:30 total) before continuing. This blocks the entire startup.

What Should Happen?

The OCSP responder URL in the certificate should return a valid response, or the certificate should be rotated to one with a working OCSP endpoint. Additionally, the Claude CLI should not perform synchronous certificate trust evaluation with no timeout on the startup path — it should either use async evaluation or set a short timeout so a failing OCSP check doesn't block the user for minutes.

Error Messages/Logs

No visible error is shown to the user — Claude just hangs silently. The evidence comes from sampling the process during the hang:

sudo sample $(pgrep -n claude) 90 -file /tmp/claude_sample.txt

The call stack shows:
SecTrustEvaluateWithError  (in Security)
  SecTrustEvaluateInternal
    SecTrustEvaluateIfNecessary
      __SecTrustEvaluateIfNecessary_block_invoke
        __SecTrustEvaluateIfNecessary_block_invoke_2

OCSP URL returns 404:
curl -v http://o.pki.goog/s/we1/HRE
→ HTTP/1.1 404 Not Found

Steps to Reproduce

1. On macOS with default OCSP settings (/Library/Preferences/com.apple.security.revocation unset)
2. Run time claude -p "reply ok" in a terminal
3. Observe ~60s hang before any output (up to ~2:30 in interactive mode, suggesting multiple sequential evaluations)
4. While hanging, run sudo sample $(pgrep -n claude) 90 -file /tmp/sample.txt in a second terminal
5. Open /tmp/sample.txt — main thread is blocked in SecTrustEvaluateWithError for the entire sample duration
6. Confirm OCSP URL is dead: curl http://o.pki.goog/s/we1/HRE returns 404

Workaround (user side):
sudo defaults write /Library/Preferences/com.apple.security.revocation OCSPStyle None

Claude Model

Not sure / Multiple models

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.193

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_