[BUG] SSL certificate configuration don't work with web page `Fetch` (but works with MCP)

[saiya]

Environment

• Platform (select one):
  • Anthropic API
  • AWS Bedrock
  • Google Vertex AI
  • Other:
• Claude CLI version: 1.0.56 (Claude Code)
• Operating System: Mac OS 15.5
• Terminal: Terminal.app

Bug Description

Despite having SSL_CERT_FILE and NODE_EXTRA_CA_CERTS configuration (as suggested here), Claude Code fails to fetch web pages.

Steps to Reproduce

1. Set up PC with a company's network tool that intercepts HTTPS/TLS (at the OS layer) but is NOT a proxy
2. Configure SSL_CERT_FILE and NODE_EXTRA_CA_CERTS in ~/.claude/settings.json (do NOT set HTTPS_PROXY because the network tool is not a proxy)
3. Have Claude Code fetch any web page
4. Choose yes for the Do you want to proceed?

Expected Behavior

Claude Code should be able to fetch web pages.

Actual Behavior

Claude Code displays the error message: Error: Domain yahoo.co.jp is not allowed to be fetched.

Additional Context

1. Even under the same configuration and setup, remote MCP works well despite also using HTTPS communication
2. If I temporarily turn off the company's network interception tool, web page fetching works correctly
3. When I ask Claude Code to show environment variables, it correctly displays the variables I set:

> Please show your environment variable value of SSL_CERT_FILE and NODE_EXTRA_CA_CERTS

⏺ Bash(echo "SSL_CERT_FILE: $SSL_CERT_FILE" && echo "NODE_EXTRA_CA_CERTS: $NODE_EXTRA_CA_CERTS")
  ⎿  SSL_CERT_FILE: /Users/s-yazaki/ZscalerRootCA.pem
     NODE_EXTRA_CA_CERTS: /Users/s-yazaki/ZscalerRootCA.pem

⏺ Both SSL_CERT_FILE and NODE_EXTRA_CA_CERTS are set to /Users/s-yazaki/ZscalerRootCA.pem, indicating you're using Zscaler's corporate proxy with custom CA certificates.

4. Even under the same configuration and setup (with the company's tool enabled), using curl through Claude Code works correctly

> Can you try `curl` on that page? It likely works

⏺ Bash(curl -s https://yahoo.co.jp | head -20)
  ⎿  (No content)

⏺ Bash(curl -I https://yahoo.co.jp)
  ⎿  HTTP/1.1 301 Redirect
     Date: Mon, 21 Jul 2025 04:34:17 GMT
     Connection: close
     … +11 lines (ctrl+r to expand)

(snip)

⏺ Yes, curl works fine! The page loads successfully through the corporate proxy. The issue is that the WebFetch tool has domain restrictions that prevent it from accessing yahoo.co.jp, even though the network connection works properly through curl with the Zscaler certificates.

[johnpangalos]

Seems to be a node issue as when I just tried using fetch with node it didn't work. Setting this environment variable seems to fix the issue though:

export NODE_OPTIONS="--use-system-ca"

It's relatively new so you might have to upgrade your version of node. Latest LTS supports this flag.

[saiya]

Thank you for sharing, NODE_OPTIONS (with the latest LTS node.js & re-install claude npm package) worked well as workaround.

Through the inconsistency between MCP and WebFetch looks a bug (and cause some inconvenience on company network setup), thus I would like to keep this issue opened and hoping Anthorpics fixes it at some moment...

[kisnandor2]

I can confirm! On company network the Fetch was failing. Disabling the VPN was until now my only way to solve it (or force use curl). Using NODE_OPTIONS does the trick. Huge thanks @johnpangalos 🤗

[github-actions]

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.