Knowledge base · TOPIC-12

TLS inspection and AI coding agents

Short answer: a TLS-inspecting intermediary can present a replacement certificate or alter connection behavior. A client that does not trust that chain can fail before HTTP, even when a browser succeeds.

OpenAI’s network guidance discusses TLS inspection and WebSocket handling; GitHub documents custom-certificate errors for Copilot. These are provider-reported constraints. The certificate chain observed on your machine is local evidence. It does not, by itself, prove malicious interception or explain every application failure.

Inspect certificate issuer and validation results locally, without exporting private keys or credentials. Compare with an administrator-approved non-inspected path, and ask the network owner whether inspection is expected. Never “fix” the symptom by disabling certificate validation or installing an unverified root certificate.

Tivor Open Probe V0.1 performs certificate-validated TLS checks on governed paths and can record bounded evidence. It does not identify a proxy product, read proxy configuration, or prove which intermediary changed a connection. Run the Scanner for browser-visible evidence or Open Probe for a local check. Related: browser works but the AI agent fails.