Cannot open Dev Containers with Features - "Unable to get issuer certificate" on macOS Sequoia 15.7.3 (24G419)

Reproducible in VS Code with Dev Containers extension and the Dev Containers CLI.

This was a very hard issue to diagnose the culprit and find resolution to and I successfully chased it down to specifically the "baked in" Node that ships with Dev Containers CLI and VS Code's Dev Container's extension.

Long story short, there was some sort of issue between Dev Containers, its own Electron Node, and default macOS certificate settings. Attempting to request https://ghcr.io/... for Features failed because of certificate issues. I chased it down to having to set Keychain Access -> System Roots -> "AAA Certificate Services" trust setting to Always Trust and restarting VS Code.

Details follow below.

• VSCode Version: 1.108.0

  Version: 1.108.0 (Universal)
  Commit: 94e8ae2b28cb5cc932b86e1070569c4463565c37
  Date: 2026-01-08T13:53:10.781Z
  Electron: 39.2.7
  ElectronBuildId: 12953945
  Chromium: 142.0.7444.235
  Node.js: 22.21.1
  V8: 14.2.231.21-electron.0
  OS: Darwin arm64 24.6.0
  

• Local OS Version: macOS Sequoia 15.7.3 (24G419)
• Remote OS Version: N/A
• Remote Extension/Connection Type: Dev Containers
• Logs:

$ devcontainer up --log-level trace
[1 ms] @devcontainers/cli 0.80.1. Node.js v22.21.1. darwin 24.6.0 arm64.
[1 ms] Start: Run: docker buildx version
[231 ms] Stop (230 ms): Run: docker buildx version
[231 ms] github.com/docker/buildx v0.30.1-desktop.1 792b8327a475a5d8c9d5f4ea6ce866e7da39ae8b
[231 ms]
[231 ms] Start: Run: docker -v
[241 ms] Stop (10 ms): Run: docker -v
[241 ms] Start: Resolving Remote
[243 ms] Start: Run: git rev-parse --show-cdup
[257 ms] Stop (14 ms): Run: git rev-parse --show-cdup
[258 ms] Start: Run: docker ps -q -a --filter label=devcontainer.local_folder=/Users/justinbull/Code/core --filter label=devcontainer.config_file=/Users/justinbull/Code/core/.devcontainer/devcontainer.json
[278 ms] Stop (20 ms): Run: docker ps -q -a --filter label=devcontainer.local_folder=/Users/justinbull/Code/core --filter label=devcontainer.config_file=/Users/justinbull/Code/core/.devcontainer/devcontainer.json
[278 ms] Start: Run: docker ps -q -a --filter label=devcontainer.local_folder=/Users/justinbull/Code/core
[297 ms] Stop (19 ms): Run: docker ps -q -a --filter label=devcontainer.local_folder=/Users/justinbull/Code/core
[298 ms] Loading 7 extra certificates from /var/folders/bb/wb48gq5s73qbd05bykzctwvc0000gn/T/vsch/certificates-905a35f2932030efe830cd4ac248dd79d9680b09c8b0a8d1dd3eccba1940473a.pem.
[450 ms] Start: Run: docker ps -q -a --filter label=devcontainer.local_folder=/Users/justinbull/Code/core --filter label=devcontainer.config_file=/Users/justinbull/Code/core/.devcontainer/devcontainer.json
[475 ms] Stop (25 ms): Run: docker ps -q -a --filter label=devcontainer.local_folder=/Users/justinbull/Code/core --filter label=devcontainer.config_file=/Users/justinbull/Code/core/.devcontainer/devcontainer.json
[477 ms] Start: Run: docker inspect --type image mcr.microsoft.com/vscode/devcontainers/base:debian
[499 ms] Stop (22 ms): Run: docker inspect --type image mcr.microsoft.com/vscode/devcontainers/base:debian
[499 ms] > input: mcr.microsoft.com/vscode/devcontainers/base:debian
[499 ms] >
[499 ms] > resource: mcr.microsoft.com/vscode/devcontainers/base
[499 ms] > id: base
[499 ms] > owner: vscode
[499 ms] > namespace: vscode/devcontainers
[499 ms] > registry: mcr.microsoft.com
[499 ms] > path: vscode/devcontainers/base
[499 ms] >
[499 ms] > version: debian
[499 ms] > tag?: debian
[499 ms] > digest?: undefined
[499 ms] manifest url: https://mcr.microsoft.com/v2/vscode/devcontainers/base/manifests/debian
[723 ms] [httpOci] 404 (NoAuth): https://mcr.microsoft.com/v2/vscode/devcontainers/base/manifests/debian
[723 ms] Did not fetch target with expected mimetype 'application/vnd.docker.distribution.manifest.v2+json': {"errors":[{"code":"MANIFEST_UNKNOWN","message":"OCI image index found, but accept header does not support OCI image index"}]}
[926 ms] [httpOci] 200 (NoAuth): https://mcr.microsoft.com/v2/vscode/devcontainers/base/manifests/debian
[926 ms] Fetched: {
    "schemaVersion": 2,
    "mediaType": "application/vnd.oci.image.index.v1+json",
    "manifests": [
        {
            "mediaType": "application/vnd.oci.image.manifest.v1+json",
            "digest": "sha256:800ed0a5e8679cf1bd2a1ec1ef01d35cc497d6fda21ed8811b04fb9f938def6e",
            "size": 1816,
            "platform": {
                "architecture": "amd64",
                "os": "linux"
            }
        },
        {
            "mediaType": "application/vnd.oci.image.manifest.v1+json",
            "digest": "sha256:8d478b896e081baee5236b69d1068657282bc53142bbfb25c6e3a453ab8ce4d1",
            "size": 1815,
            "platform": {
                "architecture": "arm64",
                "os": "linux"
            }
        },
        {
            "mediaType": "application/vnd.oci.image.manifest.v1+json",
            "digest": "sha256:04707786a5a7006858251c2767ebf9180fe5fa99e9aa4cd396235ea2757507a4",
            "size": 567,
            "annotations": {
                "vnd.docker.reference.digest": "sha256:800ed0a5e8679cf1bd2a1ec1ef01d35cc497d6fda21ed8811b04fb9f938def6e",
                "vnd.docker.reference.type": "attestation-manifest"
            },
            "platform": {
                "architecture": "unknown",
                "os": "unknown"
            }
        },
        {
            "mediaType": "application/vnd.oci.image.manifest.v1+json",
            "digest": "sha256:c5105063e9cf90a76330ef0b90e43177628fc355af678cb681440e04ae5b6971",
            "size": 567,
            "annotations": {
                "vnd.docker.reference.digest": "sha256:8d478b896e081baee5236b69d1068657282bc53142bbfb25c6e3a453ab8ce4d1",
                "vnd.docker.reference.type": "attestation-manifest"
            },
            "platform": {
                "architecture": "unknown",
                "os": "unknown"
            }
        }
    ]
}
[927 ms] Error fetching image details: No manifest found for mcr.microsoft.com/vscode/devcontainers/base:debian.
[927 ms] Start: Run: docker pull mcr.microsoft.com/vscode/devcontainers/base:debian
debian: Pulling from vscode/devcontainers/base
40cd58c9e35f: Pull complete
6a828f739420: Pull complete
f097d536d3c2: Pull complete
b9eaf6747b43: Pull complete
195f4bd7ac9b: Pull complete
c67d50dab557: Pull complete
7cd63f61b0ad: Pull complete
21fa45aa1ef7: Pull complete
bf90587cfd56: Download complete
Digest: sha256:30b0a0c004ca94d36c323ee993361a7e0ae25ea255ea125201e8a9587501c324
Status: Downloaded newer image for mcr.microsoft.com/vscode/devcontainers/base:debian
mcr.microsoft.com/vscode/devcontainers/base:debian
[22710 ms] Stop (21783 ms): Run: docker pull mcr.microsoft.com/vscode/devcontainers/base:debian
[22710 ms] Start: Run: docker inspect --type image mcr.microsoft.com/vscode/devcontainers/base:debian
[22738 ms] Stop (28 ms): Run: docker inspect --type image mcr.microsoft.com/vscode/devcontainers/base:debian
[22739 ms] workspace root: /Users/justinbull/Code/core
[22739 ms] configPath: /Users/justinbull/Code/core/.devcontainer/devcontainer.json
[22739 ms] --- Processing User Features ----
[22739 ms] [* user-provided] ghcr.io/devcontainers/features/node:1, ghcr.io/anthropics/devcontainer-features/claude-code:1.0, ghcr.io/devcontainers/features/github-cli:1
[22739 ms] Resolving Feature dependencies for 'ghcr.io/devcontainers/features/node:1'...
[22739 ms] * Processing feature: ghcr.io/devcontainers/features/node:1
[22740 ms] > input: ghcr.io/devcontainers/features/node:1
[22740 ms] >
[22740 ms] > resource: ghcr.io/devcontainers/features/node
[22740 ms] > id: node
[22740 ms] > owner: devcontainers
[22740 ms] > namespace: devcontainers/features
[22740 ms] > registry: ghcr.io
[22740 ms] > path: devcontainers/features/node
[22740 ms] >
[22740 ms] > version: 1
[22740 ms] > tag?: 1
[22740 ms] > digest?: undefined
[22740 ms] manifest url: https://ghcr.io/v2/devcontainers/features/node/manifests/1
Error: unable to get issuer certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
    at TLSSocket.emit (node:events:519:28)
    at TLSSocket._finishInit (node:_tls_wrap:1078:8)
    at ssl.onhandshakedone (node:_tls_wrap:864:12)
{"outcome":"error","message":"unable to get issuer certificate","description":"An error occurred setting up the container."}

Steps to Reproduce:

1. Be on the latest macOS Sequoia 15.7.3 (24G419)
2. Verify your Keychain Access -> System Roots -> "AAA Certificate Services" trust setting is "Use System Defaults" (which I believe is default from a new macOS install)
3. Open a project in a Dev Container which has at least one Dev Container Feature used in its devcontainer.json. In my case, it was Home Assistant's core repository: https://github.com/home-assistant/core/blob/7f4063f91ec45647845221023c2b2c8e2541438a/.devcontainer/devcontainer.json#L10-L15
4. Observe the failure similar to above when it tries to pull the feature during build

Does this issue occur when you try this locally?: N/A
Does this issue occur when you try this locally and all extensions are disabled?: N/A

So some basics to identify the cause and rule things out:

1. Installing the Dev Containers CLI into path (F1 -> Dev Containers: Install devcontainer CLI) and running devcontainer up reproduces the issue ❌
2. Running node -e "require('https').get('https://ghcr.io', res => console.log(res.statusCode))" in my terminal and VSCode integrated terminal works without issue ✅
3. curl -Iv https://ghcr.io/ works in both my terminal and VS Code's integrated terminal ✅
4. openssl s_client -connect ghcr.io:443 -servername ghcr.io -showcerts works and shows nothing crazy (like a corporate cert or proxy) ✅
5. Manually running docker pull ghcr.io/devcontainers/features/node:1 in terminal completes without issue ✅
6. Attempting to run NODE_OPTIONS="--use-openssl-ca" devcontainer up --log-level trace produces the same error with a telling warning emitted first: ❌

   [0111/135511.312227:ERROR:electron/shell/app/node_main.cc:146] Node.js environment variables are disabled because this process is invoked by other apps.
   ...
   

7. Running env | egrep -i 'https?_proxy|no_proxy|ssl_cert|node_extra_ca|node_options' shows no output: I have nothing specially configured with my node (lts/jod aka v22.14.0 managed via nvm) in my terminal ✅

From here I can tell that my CA certificate setup is working fine typically on my host machine in almost all circumstances (node, curl, openssl, docker). And that I have nothing peculiar in my environment. So I try using the devcontainer CLI directly vs the one installed in the shipped VSCode:

npx -y @devcontainers/cli@0.80.1 up --log-level trace --workspace-folder .

Miraculously it works! So the issue is isolated to VS Code's own Node for reasons I cannot ascertain.

Thanks to #9452, I found @chrmarti's Network Proxy Test extension which would shed light into where/why/how the certificate error was occurring within VSCode's Dev Container. I run it for https://ghcr.io and this is the output:

Note: Make sure to replace all sensitive information with dummy values before sharing this output.

VS Code 1.108.0 (94e8ae2b28cb5cc932b86e1070569c4463565c37)
Network Proxy Test 0.0.22
darwin 24.6.0 arm64

Built-in certificates: 146 certs
OS certificates: 8 certs

Settings:
- http.systemCertificatesNode: false

DNS:
- Servers: 2606:4700:4700::1111, 2606:4700:4700::1001, 1.1.1.1, 1.0.0.1
- Result Order: ipv4first
- Auto Select Family: true
- Auto Select Family Attempt Timeout: 250
- Lookup: 140.82.112.34 (32 ms)

Proxy:
- URL: None (1 ms)

Sending GET request to https://ghcr.io...
Received error: Error: unable to get issuer certificate
	at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
	at TLSSocket.emit (node:events:519:28)
	at TLSSocket._finishInit (node:_tls_wrap:1078:8)
	at ssl.onhandshakedone (node:_tls_wrap:864:12)
Retrying while ignoring certificate issues to collect information on the certificate chain.

Sending GET request to https://ghcr.io (allowing unauthorized)...
Received response:
- Status: 301 Moved Permanently
- Location: https://github.com/features/packages
Certificate chain:
- Subject: *.ghcr.io
  Subject alt: DNS:*.ghcr.io, DNS:ghcr.io
  Public Key Hash: DD:75:D2:E8:AF:9D:8F:1A:59:5E:77:F9:FE:A0:B3:9D:55:D9:56:F7:27:C6:20:F0:BA:94:0D:BB:03:93:53:84
  Validity: May 14 00:00:00 2025 GMT - May 14 23:59:59 2026 GMT
  Fingerprint: 04:79:4F:BD:9F:5F:95:50:1F:73:70:A5:B6:19:3E:02:F6:08:76:5E
- Subject: Sectigo RSA Domain Validation Secure Server CA (Sectigo Limited)
  Public Key Hash: E1:AE:9C:3D:E8:48:EC:E1:BA:72:E0:D9:91:AE:4D:0D:9E:C5:47:C6:BA:D1:DD:DA:B9:D6:BE:B0:A7:E0:E0:D8
  Validity: Nov  2 00:00:00 2018 GMT - Dec 31 23:59:59 2030 GMT
  Fingerprint: 33:E4:E8:08:07:20:4C:2B:61:82:A3:A1:4B:59:1A:CD:25:B5:F0:DB
- Subject: USERTrust RSA Certification Authority (The USERTRUST Network)
  Public Key Hash: C7:84:33:3D:20:BC:D7:42:B9:FD:C3:23:6F:4E:50:9B:89:37:07:0E:73:06:7E:25:4D:D3:BF:9C:45:BF:4D:DE
  Validity: Mar 12 00:00:00 2019 GMT - Dec 31 23:59:59 2028 GMT
  Fingerprint: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C
  Issuer certificate 'AAA Certificate Services (Comodo CA Limited)' not in certificate chain of the server.
Local root certificates:
- Subject: C=GB ST=Greater Manchester L=Salford O=Sectigo Limited CN=Sectigo RSA Domain Validation Secure Server CA (OS)
  Public Key Hash: E1:AE:9C:3D:E8:48:EC:E1:BA:72:E0:D9:91:AE:4D:0D:9E:C5:47:C6:BA:D1:DD:DA:B9:D6:BE:B0:A7:E0:E0:D8
  Validity: Nov  2 00:00:00 2018 GMT - Dec 31 23:59:59 2030 GMT
  Fingerprint: 33:E4:E8:08:07:20:4C:2B:61:82:A3:A1:4B:59:1A:CD:25:B5:F0:DB
  Issuer: C=US ST=New Jersey L=Jersey City O=The USERTRUST Network CN=USERTrust RSA Certification Authority
  Key usage: 1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2
- Subject: C=US ST=New Jersey L=Jersey City O=The USERTRUST Network CN=USERTrust RSA Certification Authority (built-in and OS)
  Public Key Hash: C7:84:33:3D:20:BC:D7:42:B9:FD:C3:23:6F:4E:50:9B:89:37:07:0E:73:06:7E:25:4D:D3:BF:9C:45:BF:4D:DE
  Validity: Feb  1 00:00:00 2010 GMT - Jan 18 23:59:59 2038 GMT
  Fingerprint: 2B:8F:1B:57:33:0D:BB:A2:D0:7A:6C:51:F7:0E:E9:0D:DA:B9:AD:8E
  Issuer: C=US ST=New Jersey L=Jersey City O=The USERTRUST Network CN=USERTrust RSA Certification Authority
- Subject: C=US ST=New Jersey L=Jersey City O=The USERTRUST Network CN=USERTrust RSA Certification Authority (OS)
  Public Key Hash: C7:84:33:3D:20:BC:D7:42:B9:FD:C3:23:6F:4E:50:9B:89:37:07:0E:73:06:7E:25:4D:D3:BF:9C:45:BF:4D:DE
  Validity: Mar 12 00:00:00 2019 GMT - Dec 31 23:59:59 2028 GMT
  Fingerprint: D8:9E:3B:D4:3D:5D:90:9B:47:A1:89:77:AA:9D:5C:E3:6C:EE:18:4C
  Issuer: C=GB ST=Greater Manchester L=Salford O=Comodo CA Limited CN=AAA Certificate Services

The key line is:

  Issuer certificate 'AAA Certificate Services (Comodo CA Limited)' not in certificate chain of the server.

So I look at my Keychain Access's System Roots and indeed I do have the AAA Certificate Services valid certificate. And its trust is set to "Use System Defaults". I decided to set it to "Always Trust" as a hail mary:

Alas it worked after rebooting VS Code. Most curiously toggling the Trust back to "Use System Defaults" no longer reproduces the error.

I'm reporting this issue here because from what I can tell having the latest VS Code, Dev Containers, and macOS 15.x created conditions where this bug was expressed. If it happened to me, it may be happening to others. Whatever "it" is, anyway. And it resolution shouldn't require users to make modifications to macOS' keychain defaults.