opencode auth login issue with corporate proxy

[BLaurent]

Hi everyone,

I am trying to run opencode on a mac behind a corporate proxy that does ssl MIM.

It is failing with the following error:

INFO  2025-07-03T09:54:57 +32ms service=default version=0.1.176 args=auth,login opencode
INFO  2025-07-03T09:54:57 +9ms service=models.dev refreshing
ERROR 2025-07-03T09:54:58 +1546ms service=default name=Error message=self signed certificate in certificate chain fatal

Do I need to add my corporate certificate somewhere ?

Thanks in advance
B

[thdxr]

does setting NODE_EXTRA_CA_CERTS help?

[blytheaw]

@BLaurent I had this issue as well. Exporting SSL_CERT_FILE with my company's CA cert bundle worked for me. I'm behind Zscaler with SSL inspection happening

[BLaurent]

Hi,
I tried to set NODE_EXTRA_CA_CERTS but this doesn't change anything.
I tried using copilot, mistral.

With copilot the auth process do not go through
With mistral when I enter a prompt I get : "Error: self signed certificate in certificate chain"

[ShuviSchwarze]

Have you tried setting NODE_TLS_REJECT_UNAUTHORIZED to 0?

[BLaurent]

If I set this flag the error message goes away. But is it really safe to do so ?

[ShuviSchwarze]

Basically zscaler disable encryption on traffics going from the system anyway, so it's one of the few things that you can do. Otherwise you'll have to mess with passing the zcsaler root cert to nodejs, and I personally havent had much luck with that approach. You kinda just hope that zscaler catches any bad traffics for you, should be pretty safe either way.

[BLaurent]

Ok seems to work with those tweaks.
Thanks