Claude Code SSL Certificate Error

The error string tells you which layer is failing, and each one maps to a specific fix below.

One test settles the cause in ten seconds. Run Claude Code on a network without inspection — a phone hotspot works — or ask IT for a bypass rule on api.anthropic.com. If it connects there and fails on the corporate network, the proxy is re-signing your traffic and you need a CA fix, not a reinstall.

Before you touch a config file, decide which problem you actually have. The certificate fixes assume you can get your company's CA and set an environment variable. That is not always true, and forcing it wastes an afternoon.

Most corporate networks run a TLS-inspection proxy. Knowing what it does tells you why the error appears and where the fix lives.

Zscaler, Netskope, Cato, CrowdStrike Falcon, or a full-tunnel VPN all do the same job: read outbound HTTPS for data-loss prevention and malware scanning. To read an encrypted stream, the box has to sit in the middle. It terminates your connection to api.anthropic.com, decrypts it, then makes its own connection onward and re-signs the response with the company's private certificate authority.

Your browser trusts that re-signed certificate because IT pushed the corporate root CA into the browser and OS trust stores when they set up the laptop. Claude Code is a separate runtime with its own idea of what to trust — and that is where the mismatch lives.

Here is the part most write-ups get wrong. Modern Claude Code already reads your OS trust store. By default it trusts both its bundled Mozilla CA set and the operating system's certificate store. Reading the OS store needs a runtime that exposes tls.getCACertificates: the native installer always has it, and npm installs need Node 22.15 or later. On older Node, only the bundled set and NODE_EXTRA_CA_CERTS apply. So when IT has installed the corporate root in the OS store and you are on a current build, inspection proxies like Zscaler and CrowdStrike Falcon work with no extra configuration at all. The errors show up in the gaps: an old npm-based install, a CA that never made it into the OS store, or a runtime launched in a way that skips it.

The exact string narrows the cause. This is the same taxonomy Node and OpenSSL use, so it applies whether Claude Code runs on the native binary or an npm install.

The split matters. A verify error on every API call is a trust-store problem you fix once with a CA. A revocation error at install time is the firewall blocking a lookup, and you work around it for the single install command rather than changing your trust configuration.

Work top down. The earlier fixes are cleaner and less risky than the later ones.

node --version

export CLAUDE_CODE_CERT_STORE=bundled,system

export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.pem
claude

curl --cacert /path/to/corporate-ca.pem -fsSL https://claude.ai/install.sh | bash

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
irm https://claude.ai/install.ps1 | iex

curl --ssl-revoke-best-effort -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd

export HTTPS_PROXY=https://proxy.example.com:8080
export HTTP_PROXY=http://proxy.example.com:8080
export NO_PROXY="localhost,127.0.0.1,.internal.example.com"

export HTTPS_PROXY=http://username:password@proxy.example.com:8080

export CLAUDE_CODE_CLIENT_CERT=/path/to/client-cert.pem
export CLAUDE_CODE_CLIENT_KEY=/path/to/client-key.pem
export CLAUDE_CODE_CLIENT_KEY_PASSPHRASE="your-passphrase"

Abstract steps are easy to fumble, so here is the whole thing for the most common setup — a Mac behind Zscaler. It takes about five minutes.

1. 1.Confirm it is really the proxy. Tether to your phone and run claude. If it connects there, the corporate network is intercepting and you continue below.
2. 2.Export the Zscaler root from the Keychain. Open Keychain Access, search for the corporate root (often named Zscaler Root CA), select it, and use File then Export Items to save it as zscaler-root.pem in your home folder. If it exports as .cer, convert it:
3. 3.Point Claude Code at it and make it stick:

openssl x509 -inform der -in zscaler-root.cer -out zscaler-root.pem

echo 'export NODE_EXTRA_CA_CERTS="$HOME/zscaler-root.pem"' >> ~/.zshrc
source ~/.zshrc

Open a fresh terminal so the export is loaded, then start claude. The SSL error is gone.

curl --cacert "$NODE_EXTRA_CA_CERTS" -svo /dev/null https://api.anthropic.com 2>&1 | grep -E "issuer|verify"

Containers are where this error resurfaces after you thought it was solved, because a fresh container does not inherit your laptop's OS trust store. Your host trusts the corporate CA; the Ubuntu base image inside Docker does not.

Bake the CA into the image and register it in both the OS store and the Node variable:

COPY corporate-ca.pem /usr/local/share/ca-certificates/corporate-ca.crt
RUN update-ca-certificates
ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corporate-ca.crt

The same logic covers CI runners and remote dev boxes: a GitHub Actions or GitLab runner behind the same proxy needs the CA present in the job environment, usually as a secret file written at the start of the job with NODE_EXTRA_CA_CERTS exported before any claude step. Devcontainers need the ENV line above in their Dockerfile. If you only fixed your shell profile, the container never saw it.

Every variable above can live in the env block of ~/.claude/settings.json, which is the tidy option for a machine you configure once.

{
  "env": {
    "NODE_EXTRA_CA_CERTS": "/path/to/corporate-ca.pem",
    "HTTPS_PROXY": "https://proxy.example.com:8080"
  }
}

There is a caveat worth stating plainly. Some earlier versions ignored NODE_EXTRA_CA_CERTS when it was set only in settings.json, and the desktop app did not always forward it to the CLI subprocess it spawns. Both have surfaced as tracked GitHub issues. If the settings.json value does nothing, the reliable fallback is the shell export in your profile, which every build honors because Node reads it before Claude Code starts.

These show up next to the certificate errors and get mistaken for them.

That last row is the quiet one. If claude works in your terminal but the VS Code or JetBrains panel throws the SSL error, the editor was launched from the dock and never saw your .zshrc. Set the variables in the IDE's own environment, or start the editor from a shell where they are already exported.

If the proxy demands NTLM or Kerberos, or you simply cannot get the CA, adding certificates is a dead end. Put an LLM gateway in front that speaks that scheme.

A gateway terminates its own TLS and handles the messy proxy negotiation once, so every developer points at one endpoint instead of each person fighting their own trust store. Pointing Claude Code at a custom endpoint is a one-line change — set two variables:

export ANTHROPIC_BASE_URL=https://your-gateway.example/anthropic
export ANTHROPIC_API_KEY=sk-...

Be honest about what this does and does not solve. The corporate proxy still re-signs traffic to the gateway host, so you may still need the corporate CA in your trust store for it. What the gateway buys you is one egress endpoint for the whole team, a single billing and usage view across providers, and a place to put failover when one upstream is unreachable.

The gateway is the escape hatch, not the default. When you can get the CA, Fix 1 or Fix 2 is simpler and keeps you on the direct path.

The fixes above get Claude Code talking through your proxy. The rest is the part worth acting on before someone ships the anti-fix.

You can read this error two ways. The narrow way: a proxy re-signs your traffic, add the CA, move on. The useful way: a security control your company put in place is now the thing blocking your tooling — and the most common workaround people reach for silently removes the protection entirely.

We see this in nearly every AI system we audit. A team slaps NODE_TLS_REJECT_UNAUTHORIZED=0 into a script to make an error go away, that script gets copied into CI, and a year later an attacker on the network is reading every API key it sends. The certificate error is a small thing. The reflex to disable validation is the real vulnerability.

Three things make a setup survive these environments:

If your team's workaround for a certificate error is to turn off certificate checks, the error wasn't the problem — the workaround was.

About FACTA

FACTA helps startups and growth-stage teams turn AI into production systems that keep running — not demos that impress once.

We design the architecture around the parts that actually break under real usage: model abstraction, credentials you own, failover, cost controls, observability. The boring infrastructure that keeps a system alive after launch.

Led by Matías Baglieri and Carolina Fogliato, we focus on one thing:

AI leadership that builds. Not just advises.