trust/skip TLS verification for MCP HTTP servers

Describe the feature or problem you'd like to solve

trust/skip TLS verification for MCP HTTP servers with invalid SAN certs (rustls hard-fails, no insecure option)

Proposed solution

Copilot CLI cannot connect to a remote HTTP MCP server whose TLS certificate has an invalid Subject Alternative Name (e.g., a literal  *  instead of a proper wildcard/IP SAN), even after the cert's issuing CA is explicitly trusted. There is no config option or environment variable to bypass hostname/certificate verification for a specific MCP server, which blocks use cases like connecting to on-prem/IoT devices with embedded mcp server and self-managed certificates addressed by IP Address.

Steps to reproduce

1. device that presents a self-signed certificate whose Subject/SAN is not a valid match for the IP address (e.g., CN/SAN =  * )
2. Export and trust the CA:  export NODE_EXTRA_CA_CERTS=~/ctrlx.pem 
3. Run  copilot , then  /mcp  — the server still fails to connect.

Requested behavior

The CLI offers a supported way to relax verification for a specific MCP server (e.g., a per-server  tls.insecureSkipVerify or honoring a documented env var), similar to how  curl -k  or Node's  NODE_TLS_REJECT_UNAUTHORIZED=0  work for other tools.

Example prompts or workflows

NA

Additional context

• Related: #4364 documents a similar underlying issue (rustls/rustls-platform-verifier being stricter than curl/Node/Chrome for enterprise MCP registry TLS), suggesting this is a broader gap in the Rust-based MCP networking layer, not specific to one code path.
• For comparison, Claude Code and Gemini CLI's MCP clients run on Node.js, so  NODE_TLS_REJECT_UNAUTHORIZED=0  works as an (insecure) escape hatch there; Copilot CLI has no equivalent because of the runtime split.
• Use case: connecting to on-prem/IoT devices reachable only via IP address with vendor-managed self-signed certificates that can't easily be reissued with a proper SAN.

Đọc issue liên quan #4364, sau đó truy vết lớp mạng MCP dựa trên Rust được sử dụng khi /mcp kết nối đến một máy chủ HTTP. Tái hiện lỗi với chứng chỉ có SAN không hợp lệ và xác định nơi sẽ áp dụng một tùy chọn không an toàn theo từng máy chủ hoặc một biến môi trường được ghi lại; hoàn thành nghĩa là CLI có thể kết nối đến máy chủ đó thông qua cấu hình được hỗ trợ.