[Windows][Remote Control] WebSocket TLS fails with UNABLE_TO_VERIFY_LEAF_SIGNATURE after successful enrollment

What version of the Codex App are you using (From “About Codex” dialog)?

ChatGPT/Codex Desktop: 26.903.8094.0 Bundled Codex CLI: 0.153.4

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Windows 11 Professional x64 OS version: 10.0.26200 System language: ja-JP

What issue are you seeing?

Remote Control fails when attempting to connect from the Windows desktop app to an already enrolled remote Windows device.

Device enrollment and authentication succeed, and the remote device is discovered and displayed in the desktop app.

However, when the app attempts to open the Remote Control WebSocket transport, the connection fails before the WebSocket is opened with:

UNABLE_TO_VERIFY_LEAF_SIGNATURE

"unable to verify the first certificate; if the root CA is installed locally, try running Node.js with --use-system-ca"

The application then repeatedly retries and fails with the same TLS certificate verification error.

Relevant sanitized log sequence:

remote_control_client_refresh_finish_response ... scopes=["remote_control_controller_websocket"]

remote_control_websocket.connect_failed_before_open ...
errorCode=UNABLE_TO_VERIFY_LEAF_SIGNATURE
errorMessage="unable to verify the first certificate; if the root CA is installed locally, try running Node.js with --use-system-ca"

app_server_connection.transport_connect_failed ...
transport=websocket

Screenshot of the error:

What steps can reproduce the bug?

1. Enable Remote Control on a Windows machine that will be controlled remotely.

2. On another Windows 11 machine, open the ChatGPT/Codex desktop app.

3. Go to Settings > Connections > Control other devices.

4. Pair/enroll the remote machine using the normal device approval/PIN flow.

5. The remote Windows device appears successfully in the device list.

6. Attempt to connect to / enable the enrolled remote device.

7. The connection fails with:

   unable to verify the first certificate;
   if the root CA is installed locally,
   try running Node.js with --use-system-ca

8. The desktop app automatically retries and repeatedly fails with
   UNABLE_TO_VERIFY_LEAF_SIGNATURE.

What is the expected behavior?

After successful enrollment and authentication, the Remote Control WebSocket should establish normally and the enrolled Windows device should become available for remote control.

Additional information

I performed additional diagnostics to isolate the problem.

Codex Doctor v0.153.4:

• 22 ok
• 1 idle
• 1 note
• 1 warning
• 0 failures

Connectivity diagnostics:

• Codex Doctor WebSocket test succeeds:
  HTTP 101 Switching Protocols
• ChatGPT provider endpoints are reachable.
• No proxy environment variables are configured.
• WinHTTP reports direct access / no proxy.
• Browser access to https://chatgpt.com uses a normal Let's Encrypt certificate.

Bundled Node runtime test:

Default Node HTTPS request:
https://chatgpt.com -> HTTP 403

Same request with:
node --use-system-ca

Result:
https://chatgpt.com -> HTTP 403

Therefore TLS certificate verification succeeds in both the bundled Node runtime's
default mode and with --use-system-ca.

The Remote Control transport inside the desktop application is the only tested
path that produces UNABLE_TO_VERIFY_LEAF_SIGNATURE.

The same remote Windows target can also be controlled normally from the ChatGPT
mobile app, so the target machine and Remote Control enrollment itself appear to
be working.

Third-party antivirus:

• Norton Antivirus is active.
• No corresponding blocked connection was found in Norton's intrusion-prevention
  connection history or security history.
• Interestingly, Codex Doctor reports:
  "no supported endpoint protection detected"

Possibly related but distinct issue:
openai/codex#41121

That issue reports HTTP 403 after successful Remote Control enrollment.
In this case, authentication/enrollment succeeds, but the subsequent desktop
WebSocket transport fails locally during TLS certificate verification before
the WebSocket opens.

I can provide a sanitized desktop log if needed.

No source file or test is identified. Start by tracing the desktop app's Remote Control WebSocket transport and its bundled Node TLS configuration, then reproduce the enrollment and connection flow on Windows 11; done means the WebSocket opens successfully after enrollment without UNABLE_TO_VERIFY_LEAF_SIGNATURE.