[BUG] Linux native binary: MCP HTTPS fails UNKNOWN_CERTIFICATE_VERIFICATION_ERROR for chains anchored on roots newer than the embedded bundle; CLAUDE_CODE_CERT_STORE has no effect

Summary

A streamable-HTTP MCP server behind a valid Let's Encrypt chain (leaf <- YR2 <- ISRG Root YR, cross-signed to ISRG Root X1) fails to connect from the Claude Code native Linux binary with UNKNOWN_CERTIFICATE_VERIFICATION_ERROR, while every other TLS stack on the same machine verifies the same URL: curl, openssl s_client (Verify return code 0), plain Node https, and undici fetch (including a successful authenticated MCP initialize handshake done manually over undici).

Confirmed cross-distro on 2026-07-29: Debian 12 (node:22-bookworm image) and Ubuntu 24.04 (current ca-certificates) fail identically. macOS, same claude version, same endpoint and same .mcp.json: connects fine.

What was tested and had no effect

• NODE_EXTRA_CA_CERTS (single cert and full bundle)
• SSL_CERT_FILE and SSL_CERT_DIR
• Manually installing the cross-signed ISRG Root YR into /usr/local/share/ca-certificates + update-ca-certificates (openssl then verifies with the system store; claude still fails)
• CLAUDE_CODE_CERT_STORE=bundled
• CLAUDE_CODE_CERT_STORE=system (with the root present in the system store)
• apt-get install --only-upgrade ca-certificates (Debian 12 ships a 2023 bundle; ISRG Root YR, issued May 2026, is not available)

NODE_TLS_REJECT_UNAUTHORIZED=0 was deliberately not used.

Expected

Either the embedded bundle keeps pace with active Let's Encrypt roots, or CLAUDE_CODE_CERT_STORE=system genuinely delegates to the system store on Linux, or NODE_EXTRA_CA_CERTS is honored. Any one of the three would unblock this.

Repro

1. Any current Linux container (node:22-bookworm or ubuntu:24.04 + Node 22 + npm install -g @anthropic-ai/claude-code, 2026-07-29 latest).
2. .mcp.json with a type http MCP server whose certificate chains through ISRG Root YR (any current Let's Encrypt RSA cert).
3. claude mcp list -> Failed to connect, UNKNOWN_CERTIFICATE_VERIFICATION_ERROR.

Impact

All Linux developer seats in our org are blocked from HTTPS MCP servers on current Let's Encrypt certs; macOS seats are unaffected. Appears closely related to #31777 (same error signature, env vars ignored), with the added datapoint that both CLAUDE_CODE_CERT_STORE modes are ineffective and the failure reproduces on fully-patched Ubuntu 24.04.