macOS: Remote Control fails with a trusted enterprise CA unless NODE_USE_SYSTEM_CA=1 is set

What version of the Codex App are you using (From “About Codex” dialog)?

26.901.51231 (build 8109), read from the installed application's Info.plist.

What subscription do you have?

ChatGPT account with Remote Control available; subscription tier not specified.

What platform is your computer?

macOS 26.6.1 (25G76), Apple Silicon (arm64).

What issue are you seeing?

When using the desktop app on this Mac to control Codex on a Mac mini, the remote device appears in Settings, but the connection fails with:

self signed certificate in certificate chain

The controller Mac is on a corporate network with HTTPS inspection. The corporate root CA is installed in the macOS System keychain. The root certificate's SHA-256 fingerprint matches the root in the certificate chain presented when connecting to chatgpt.com, and command-line TLS verification succeeds.

However, the desktop app's Remote Control WebSocket fails before it opens. Relevant log fields, with identifiers omitted:

[remote-control-transport] remote_control_websocket.connect_failed_before_open
errorCode=SELF_SIGNED_CERT_IN_CHAIN
errorMessage="self signed certificate in certificate chain"
errorName=Error

[AppServerConnection] app_server_connection.transport_connect_failed
errorCode=SELF_SIGNED_CERT_IN_CHAIN
transport=websocket

The error stack points to Node.js TLS:

at TLSSocket.onConnectSecure (node:internal/tls/wrap:1768:34)

What steps can reproduce the bug?

1. Use a Mac on a network with corporate HTTPS inspection, with the corporate root CA installed and trusted in macOS.
2. Launch the desktop app normally.
3. Open Settings → Connections → Control other devices and connect to an already-added Mac mini.
4. Observe the certificate error above.
5. Completely quit the desktop app.
6. Launch the same installed application with system CA support enabled:

NODE_USE_SYSTEM_CA=1 /Applications/ChatGPT.app/Contents/MacOS/ChatGPT

7. Connect to the same Mac mini again.

Confirmed result: enabling NODE_USE_SYSTEM_CA=1 resolved the Remote Control connection failure on the same controller Mac and network. TLS verification was not disabled.

The executable path above is the actual application bundle path on this installation.

What is the expected behavior?

Remote Control should be able to use enterprise CAs already trusted by macOS, or the desktop app should provide a supported, discoverable CA configuration option and actionable guidance when this error occurs.

Users should not need to discover a launch-time environment variable to connect through a corporate network whose CA is already trusted by the operating system.

Additional information

• All three certificates in the observed chain were within their validity periods.
• curl, OpenSSL, and the separately installed Node.js v26.8.1 successfully verified the connection in this environment.
• The successful launch with NODE_USE_SYSTEM_CA=1 suggests a difference between the Remote Control module's default CA configuration and macOS trust. This is an inference from the before/after behavior, rather than a confirmed implementation-level root cause.
• Please review whether the Remote Control WebSocket should load the system CA store by default or expose an explicit setting for this.

Reproduce from the installed /Applications/ChatGPT.app/Contents/MacOS/ChatGPT entry point, comparing the Remote Control WebSocket failure with and without NODE_USE_SYSTEM_CA=1 and reviewing the Node.js TLS stack named in the report. Done means the app handles the trusted macOS enterprise CA by default, or exposes documented CA configuration and actionable guidance for the reported certificate-chain case.