Claude Code error
Claude Code: Unable to connect to API: SSL certificate verification failed...
Unable to connect to API: SSL certificate verification failed (UNABLE_TO_GET_ISSUER_CERT_LOCALLY).Status: WorkaroundLast verified 3 documented fixes3 sources
What it means
A proxy or security appliance on your network is intercepting TLS traffic with its own certificate, and Claude Code does not trust it. The self-signed variant reads Unable to connect to API: Self-signed certificate detected (SELF_SIGNED_CERT_IN_CHAIN). During /login it reads SSL certificate error (UNABLE_TO_GET_ISSUER_CERT_LOCALLY).
Causes
- A TLS-inspecting corporate proxy
- A gateway signed by a private CA
How to fix it
- Fix 1.
Export your organization's CA bundle and point Claude Code at it.
TerminalNODE_EXTRA_CA_CERTS=/path/to/ca-bundle.pem - Fix 2.
See Network configuration (custom CA certificates) for full setup, or add the CA to the system certificate store.
- Fix 3.
Do not set NODE_TLS_REJECT_UNAUTHORIZED=0, which disables certificate validation entirely.
More Claude Code errors
All 18 Claude Code errorsAPI Error: 500 Internal server error. This is a server-side issue, usually temporaryStatus: WorkaroundAPI Error: Repeated 529 Overloaded errors. The API is at capacityStatus: WorkaroundAPI Error: 400 {"type":"error","error":{"type":"invalid_request_error","message":"messages.5: `tool_use` ids were found without `tool_result` blocks immediately after: toolu_01FRvEykWmCgrgJ22mvBbKhV. Each `tool_use` block must have a corresponding `tool_result` block in the next message."}}Status: OpenUnable to connect to API. Check your internet connectionStatus: WorkaroundPlease run /login · API Error: 401 OAuth token has expiredStatus: WorkaroundOAuth error: timeout of 15000ms exceededStatus: OpenPrompt is too longStatus: WorkaroundYou've hit your session limit · resets 3:45pmStatus: By design
Related reading
- Claude Code Idle Compaction: What It Does and How to Turn It OffClaude Code 2.1.299 compacts sessions over 200K tokens after about 54 idle minutes. How the cache math works, the setting to turn it off, and when to keep it.
- Claude Code Desktop SneakPeek Flaw: Fixed Version and What To DoSneakPeek (CVSS 8.7) let a poisoned HTML file read SSH keys and cloud credentials via the Claude Code Desktop preview pane. Fixed in Claude Desktop 1.30096.1.
- Reverse Engineer Anything (REA): What the MCP Server Does and Where the Line IsREA (Reverse Engineer Anything) is an MIT-licensed MCP server that lets Claude Code, Codex or Cursor inspect binaries, Electron apps and APKs. How to try it.
- Claude Code Projects: Coordinator, Threads, and LimitsClaude Code Projects is open to waitlisted Pro and Max users. How the coordinator and cloud threads work, what they cost in plan limits and where it breaks.
- Agent Harness Lessons From a 500B-Token Decompile: Give Agents a PASS/FAIL OracleAgent harness lessons from a 500B+ token decompile: a byte-matching PASS/FAIL oracle beat the reviewer agent. How agents cheated it and what to copy.
- Claude for Startups Offer Paused: What Founders Do NowClaude for Startups paused its free Claude Team year and $1,000 API credit offer at capacity. What the program page says now and how to cover the gap.
FAQ
What does "Unable to connect to API: SSL certificate verification failed..." mean in Claude Code?
A proxy or security appliance on your network is intercepting TLS traffic with its own certificate, and Claude Code does not trust it. The self-signed variant reads Unable to connect to API: Self-signed certificate detected (SELF_SIGNED_CERT_IN_CHAIN). During /login it reads SSL certificate error (UNABLE_TO_GET_ISSUER_CERT_LOCALLY).
How do I fix "Unable to connect to API: SSL certificate verification failed..."?
There are 3 documented fixes. Start with the first: Export your organization's CA bundle and point Claude Code at it.
Is this Claude Code error fixed?
Status: Workaround. No release removes the cause. The documented fixes work around it. Affected versions: All versions. Since v2.1.199 certificate failures are not retried; v2.1.273 added the OpenSSL code and NODE_EXTRA_CA_CERTS hint; v1.0.40 fixed this error appearing when NODE_EXTRA_CA_CERTS was set.
Sources
Last verified against 3 sources: official docs, maintainer replies and release notes.
Newsletter
Fixes for the tools you use, weekly
One email per week. New coding agent releases, what broke, and how developers are working around it.