claude-code - 💡(How to fix) Fix [BUG] running 'claude install' no longer works w/ system cert store [3 comments, 2 participants]

When I run claude install, I get an error related to getting local issuer certificates. I would expect to be able to run claude install and it respect the default of 'system,bundled' as laid out in the docs.

Error Messages/Logs

Have some sort of private CA in your trust store on MacOS, and something actively MITMing all your traffic with a certificate from that private CA (e.g. zScaler,) and then try to run claude install. My error messages show the combination of options showing neither work.

TL;DR

The issue is likely due to a private CA in the trust store on MacOS interfering with the certificate verification of the claude install command, and a potential workaround is to use the --force flag to override certificate checks.

Guidance

• The error message "unable to get local issuer certificate" suggests a certificate verification issue, which may be related to the private CA in the trust store.
• The fact that switching between the system store and the CA bundle does not make a difference implies that the issue is not with the certificate store itself, but rather with the certificate verification process.
• Using the --force flag to override certificate checks may allow the claude install command to succeed, but this should be done with caution as it may introduce security risks.
• To mitigate the issue, it may be necessary to remove or disable the private CA from the trust store, or to configure the claude install command to use a different certificate verification method.

Example

No code snippet is provided as the issue is related to certificate verification and trust stores, which is a system-level configuration.

Notes

The issue is likely specific to the MacOS platform and the presence of a private CA in the trust store. The use of the --force flag should be done with caution and only as a temporary workaround until a more permanent solution can be found.

Recommendation

Apply workaround: use the --force flag to override certificate checks, as it may allow the claude install command to succeed, but be aware of the potential security risks.