Opencode (Windows) ignores NODE_EXTRA_CA_CERTS environment variable

[watashi93]

Description

In our company, we are using an proxy which "opens" TLS enrcyption with outside of our network for DPI. This proxy issues certificates using an internal PKI. Our internal LLM models also use certificates from our internal PKI. I am running opencode in the version 1.2.24 using Node 24.14.0 on Windows 11. I have set the environment variable NODE_EXTRA_CA_CERTS pointing to a file which contains the root certificate of our internal PKI in PEM format. The certificate is valid (today is between notBefore/notAfter).

The problem:
whenever I try to use any model (internal and external) I get the error message "certificate has expired" (which definitely is wrong, any error message regarding a self-signed certificate would be correct - assuming the environment variable is ignored or our root certificate has a problem).

Steps to identify the problem:

1. Exception of external URLs of some models from SSL Decryption: these URLs work, the internal URL does not work
2. Set NODE_TLS_REJECT_UNAUTHORIZED to 0: everything works as expected - apart from having a security issue
3. Run simple programs in Node which only access these URLs: NODE_EXTRA_CA_CERTS is used, and everything works. Without NODE_EXTRA_CA_CERTS, I get the expected error message about self-signed certificates
4. Run opencode in a container on the windows machine - everything works as expected.
5. Tried the same setup in Node-Versions 20, 21 and 25

This points to a problem of the opencode-code in combination with Node for Windows. According to Copilot, Node for Windows seems to be a bit sensitive and ignores at least TLS-related environment variables, if:

• if the app overwrites https.globalAgent.options.ca
• if a package like axios, request, node-fetch, got replaces agents internally
• if the application is using tls.createSecureContext() directly

I did look at the other cases, the search has returned, but setting NODE_TLS_REJECT_UNAUTHORIZED to 0 is not a solution. Excluding URLs from SSL decryption is a workaround, but not a solution. The same is true for replacing the internal certificates for our internal models with certificates from public CAs.

Plugins

No response

OpenCode version

1.2.24

Steps to reproduce

1. open Powershell (or command)
2. set the environment variable NODE_EXTRA_CA_CERTS to the complete path of the internal root certificate
3. start opencode
4. select any model
5. enter "hi" or anything

Screenshot and/or share link

No response

Operating System

Windows 11

Terminal

Windows Terminal

[github-actions]

This issue might be related to an existing issue. Please check:

• SSL_CERT_FILE env not observed since v0.15.0 #3130: Same corporate DPI proxy scenario where SSL certificate environment variables are not observed by opencode, with the same NODE_TLS_REJECT_UNAUTHORIZED=0 workaround — though that issue is specifically about SSL_CERT_FILE rather than NODE_EXTRA_CA_CERTS.

[watashi93]

The case #3130 is very similar indeed. The big difference is, that our problem seems to be Windows-related. We don't have any problems on Linux. Unfortunately, Windows is our desktop OS.

BTW, the solution the user okimanedeep mentioned definitively does not work for us.