Contents

Issue

Claude AI fails to function within the Visual Studio application, returning an API error related to SSL certificate verification failure.

The specific error message displayed is:

API Error: Unable to connect to API. SSL Certificate verification failed. Check your proxy or corporate SSL certificates.

This issue occurs specifically when attempting to use Claude AI from within the Visual Studio development environment, while access to Claude through a web browser works normally from the same endpoint. The Claude Code extension is unable to establish a secure connection to the Anthropic API due to SSL certificate trust issues in the Node.js runtime environment.

Environment

- Cisco Secure Access (Umbrella) with SSL decryption enabled

- Visual Studio Code with Claude Code extension

- Node.js-based extension environment

- Cisco Secure Access root CA installed in machine trust store

- api.anthropic.com allowed in Cisco Secure Access policies with decryption enabled

Resolution

The issue was resolved by configuring the NODE_EXTRA_CA_CERTS environment variable to explicitly trust the Cisco Secure Access root certificate for Node.js-based applications.

Follow these steps to resolve the SSL certificate verification failure:

Step 1: Configure NODE_EXTRA_CA_CERTS Environment Variable

Set the NODE_EXTRA_CA_CERTS system environment variable to point to the Cisco Secure Access root certificate file path. This configuration allows Node.js applications to trust the intercepting certificate authority even when the root CA is already installed in the operating system trust store.

NODE_EXTRA_CA_CERTS=[path_to_secure_access_root_certificate]

Step 2: Restart Visual Studio Code

Close and restart Visual Studio Code to ensure the new environment variable configuration takes effect for the Claude Code extension.

Step 3: Restart Umbrella (Secure Access) Agent

Restart the Umbrella agent service to ensure proper certificate handling after the environment variable change.

Step 4: Verify Resolution

Test the Claude Code extension functionality within Visual Studio Code to confirm that the SSL verification error has been resolved and Claude Code is working normally.

Note: Previous attempts to resolve this issue by excluding api.anthropic.com from SSL decryption in Cisco Secure Access rules or installing certificates directly in Visual Studio did not resolve the problem, as the issue was specific to the Node.js runtime environment used by the Claude Code extension.

Cause

The root cause of this issue is a Node.js configuration requirement for SSL certificate trust. Node.js-based extensions, such as the Claude Code extension in Visual Studio, require explicit certificate authority configuration through the NODE_EXTRA_CA_CERTS environment variable to trust intercepting certificates, even when the root certificate authority is already installed in the operating system trust store.

When Cisco Secure Access performs SSL decryption on traffic to api.anthropic.com, it presents its own certificate to the client application. While web browsers can access the OS trust store to validate this certificate, Node.js applications need the NODE_EXTRA_CA_CERTS variable to be explicitly configured to trust the Secure Access root certificate. Without this configuration, the Node.js runtime fails to validate the SSL certificate chain, resulting in the SSL certificate verification error.

Related Content

- Cisco Technical Support & Downloads