Repository navigation
DEPTH_ZERO_SELF_SIGNED_CERT when using the opencode "go" plan, but custom/self-hosted providers work fine #54525
Description
Body:
Description
I'm using the opencode CLI with the built-in go plan (subscription). When I use a model I connected myself (e.g. DeepSeek via my own API key/endpoint), everything works and I can run it indefinitely. But as soon as I switch to the go plan, every request fails immediately with:
DEPTH_ZERO_SELF_SIGNED_CERT
self-signed certificate
It is completely unusable — it fails before doing any work. There is no way to get past it.
Expected behavior
The go plan should work the same way my own provider does, connecting without a TLS certificate error.
Actual behavior
DEPTH_ZERO_SELF_SIGNED_CERT is thrown on every go-plan request. Custom providers are unaffected.
Environment
opencode version: [run opencode --version]
OS: Windows 10 (build 19044), x64 — running via MSYS2/MINGW64 bash
Node.js: v24.13.1
Install: [npm global / standalone / desktop app]
TLS / network context
HTTPS_PROXY / HTTP_PROXY: not set (in my shell)
NODE_EXTRA_CA_CERTS: not set
SSL_CERT_FILE: not set
NODE_TLS_REJECT_UNAUTHORIZED: not set
My machine sits behind a network that appears to do TLS interception (corporate proxy / antivirus / MITM). Because my own provider works but the go plan does not, it looks like the go plan either:
uses a different HTTP client / TLS handling than custom providers, and doesn't respect the system certificate store or NODE_EXTRA_CA_CERTS, or
hits an endpoint that gets intercepted while my own provider does not.
Questions
Does the go plan use a different fetch/TLS stack than custom providers? If so, why would only it fail?
How can I supply a custom CA for the go plan specifically (custom CA bundle / NODE_EXTRA_CA_CERTS support)?
Is there a recommended way to run opencode behind a TLS-inspecting proxy?
Steps to reproduce
Install opencode CLI.
Add a custom/self-hosted provider (e.g. DeepSeek) and confirm it works.
Switch to the go plan.
Send any prompt → DEPTH_ZERO_SELF_SIGNED_CERT / self-signed certificate.
Any help would be appreciated — I'd like to use the go plan, but currently I can't use it at all.
Activity
opencode-agent commentedon Oct 11, 2026
Thanks for the detailed report, @13341478667!
One thing is missing before we can look into this: the version placeholders weren't filled in. Could you share:
opencode --version, and how you installed it (npmopencode-ai, npm@opencode/cli, standalone binary or desktop app). Versions 1.x and 2.x are separate implementations and handle certificates differently, so this matters.curl -v https://opencode.aifrom the same shell. It shows which certificate your network presents for that host.A note on the error itself:
DEPTH_ZERO_SELF_SIGNED_CERTmeans the certificate your machine received for the Go endpoint is itself self-signed. That usually happens when a proxy or antivirus intercepts traffic to that host but not to your custom provider's host. So it may not be a different HTTP client in OpenCode.You can reply here with the details, or edit the issue. If you edit it, please also leave a comment saying you've updated it, so we know you're done.
These issues look related, ordered from most to least likely to be relevant:
NODE_EXTRA_CA_CERTSbehind a corporate TLS-inspecting proxyopencode-agent commentedon Oct 14, 2026
Hi @13341478667, we're closing this for now. We still don't have the OpenCode version and install method we asked for, and without them we can't tell whether this is v1 or v2 or work out why only OpenCode Go hits
DEPTH_ZERO_SELF_SIGNED_CERTon your network.If it's still happening, just comment here with the output of
opencode --version, how you installed it, and the full error text, and we'll reopen it. Until then, #54095 has workarounds for networks that intercept TLS that may help.