Claude Code behind a TLS-inspecting proxy: `Failed to connect to api.anthropic.com: UNABLE_TO_GET_ISSUER_CERT_LOCALLY` or `SELF_SIGNED_CERT_IN_CHAIN`

发生场景

Source(s): https://github.com/anthropics/claude-code/issues/25084 , https://stackoverflow.com/questions/79800400 Signal: 7,746 views on Stack Overflow; the GitHub fix was confirmed by a user. Status: reported working by source, not reproduced by us.

问题

Claude Code (CLI or VS Code extension) can't reach Anthropic on a corporate network that inspects TLS (for example Zscaler). The browser works because the OS trusts the company's root certificate.

报错原文（已脱敏/规范化）

Failed to connect to api.anthropic.com: UNABLE_TO_GET_ISSUER_CERT_LOCALLY

不是这个问题时 / 边界

There's no inspecting proxy. Then the error comes from somewhere else, such as a broken local CA bundle.

根因

Node doesn't use the OS certificate store by default, so it doesn't trust the proxy's certificate.

修复步骤

1. Set NODE_USE_SYSTEM_CA=1 (supported by Node releases since August 2025, including v22 backports, per a commenter). In the VS Code extension: "claudeCode.environmentVariables": [{"name": "NODE_USE_SYSTEM_CA", "value": "1"}]. A user confirmed this fixed it.
2. (our inference) Or point NODE_EXTRA_CA_CERTS at the company root CA file in PEM format.

如何验证

Claude Code starts and answers without the certificate error.

风险提示

Do not set NODE_TLS_REJECT_UNAUTHORIZED=0 (the Stack Overflow asker's own answer). It turns off TLS certificate checking for every connection.