CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP

Updated October 31, 2026 by Alex Sorokoletov

CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP is a Claude Code environment variable: Keeps certificates that name themselves as their own issuer, which Claude Code drops by default when it cannot confirm the certificate's key signed it and no CA in the list chains to a root that did. Set it to 1 to keep them. Added in v2.1.315 and still present in v2.1.315. It is not in the official reference.

How to set it

For one session, export it in the shell that starts Claude Code:

export CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP=<value>
claude

To apply it to every session, add it to the env object of a settings file:

// ~/.claude/settings.json
{
  "env": {
    "CLAUDE_CODE_DISABLE_SELF_NAMED_CERT_DROP": "<value>"
  }
}

Release notes that mention it

• Claude Code Version Tracker: Undocumented Env Vars, Feature Gates & Models
• claude-code-env-vars-v2-1-315

Related variables

• CLAUDE_CODE_DISABLE_LOOPED_CROSS_CERT_DROP: Keeps system-store certificates that certify each other in a loop beside their root, which Claude Code otherwise drops.
• CLAUDE_CODE_CERT_STORE: Comma-separated CA sources to trust: bundled, system, or both (the default since v2.1.101).
• CLAUDE_CODE_CLIENT_CERT: Path to client certificate for mTLS.
• CLAUDE_CODE_DISABLE_AUTH_REFRESH_LOCK: Turns off the lock that coordinates a GCP or AWS credential refresh across processes.
• ANTHROPIC_API_KEY: Primary API key for Claude API.
• ANTHROPIC_AUTH_TOKEN: Alternative bearer token; takes priority over API key.
• CLAUDE_AI_AUTHORIZE_URL: Authorization URL endpoint.
• CLAUDE_BG_AUTH_SNAPSHOT_PATH: Path for snapshotting background session auth credentials to disk.

Frequently asked questions

All variables, searchable: Claude Code environment variables.