TechFixSignal
Cursor

Cursor Unable to Verify the First Certificate

When Cursor shows unable to verify the first certificate, enable Http System Certificates and Experimental System Certificates V2, then fully quit.

Reviewed by TechFixSignal EditorialSee how this guide is verified

Last checked
Sep 8, 2026
Applies to
Windows, Mac, Desktop
Fix status
Community Confirmed
Fastest useful check

Quick answer

Match the internal error unable to verify the first certificate, including siblings unable to get local issuer certificate or self signed certificate in certificate chain. Open User Settings, search Certificates, enable Http: System Certificates and Http > Experimental: System Certificates V2 for all profiles, then fully quit and relaunch Cursor. Re-run Network Diagnostics. If SSL still shows an unrecognized corporate CA, install that root CA or set NODE_EXTRA_CA_CERTS to the PEM path. Do not start with HTTP/1.1 alone — that leftover belongs mainly to Connection failed, not this certificate fingerprint.

On this page

What we're seeing

  • The exact string is often [internal] unable to verify the first certificate. Close siblings include unable to get local issuer certificate and self signed certificate in certificate chain.
  • Independent April–July 2026 first-hand reports on the Cursor forum quote those strings while Network Diagnostics warns that encrypted traffic is intercepted by an unrecognized certificate.
  • Cursor staff replies for this fingerprint point first at Http: System Certificates and Http > Experimental: System Certificates V2, then a full quit. Staff notes that HTTP/1.1 alone does not clear the local-issuer sibling.
  • A different banner such as Connection failed. Please try again, or contact support, or Unable to reach the model provider, is a different fingerprint with different first leftovers.
  • Usage-limit and rate-limit waits are out of scope.

Start here

Try these first

Fix 1

Confirm the first-certificate error

Community Confirmed

Match the certificate wording before changing network or MCP settings.

  1. Read the error. This guide is for unable to verify the first certificate, including unable to get local issuer certificate or self signed certificate in certificate chain.
  2. If the banner is Connection failed. Please try again, or contact support, stop here and use that separate guide.
  3. If the title is Unable to reach the model provider, stop here and use that separate MCP-disable guide.
  4. Run Cursor Settings → Network → Run Diagnostics and note whether SSL reports an unrecognized corporate or security-tool certificate.

Applies to Windows, Mac, Desktop

Fix 2

Enable System Certificates and System Certificates V2

Community Confirmed

April and July 2026 first-hand reports cleared this exact fingerprint after enabling Http: System Certificates and Http > Experimental: System Certificates V2, then fully quitting Cursor. Staff replies list those toggles as the first leftover for SSL-inspection paths and call System Certificates V2 the fix that works most often.

  1. Open the Command Palette and choose Open User Settings (UI).
  2. Search for Certificates.
  3. Enable Http: System Certificates.
  4. Enable Http > Experimental: System Certificates V2 for all profiles.
  5. Fully quit Cursor and relaunch it. Do not rely on Reload Window alone.
  6. Run Network Diagnostics again and retry Agent or Chat.

Applies to Windows, Mac, Desktop

Fix 3

Trust the intercepting root CA

Community Confirmed

When Diagnostics names a corporate or security-tool CA, first-hand and staff guidance is to install that root into the OS trust store or point NODE_EXTRA_CA_CERTS at the PEM file.

  1. Ask IT for the intercepting root CA as a .pem or .crt file, or export it from the Diagnostics certificate name if your org already documents it.
  2. Install the CA into the OS trusted root store for your machine.
  3. Alternatively set the NODE_EXTRA_CA_CERTS environment variable to the full path of that PEM file, then fully quit and relaunch Cursor.
  4. Re-run Network Diagnostics. The unrecognized-certificate warning should clear if the CA is trusted.

Applies to Windows, Mac, Desktop

Fix 4

Hotspot A/B, then optional HTTP/1.1

Community Confirmed

A phone hotspot confirms SSL inspection on the office network. HTTP Compatibility Mode HTTP/1.1 can help some inspection proxies, but staff replies for the local-issuer sibling say it does not replace System Certificates V2 for this fingerprint.

  1. Compare the same account on a phone hotspot with VPN and SSL-inspecting antivirus paused.
  2. If the hotspot works and the office network fails, stay on the certificate leftovers above.
  3. Only after System Certificates V2 and the root CA steps, consider Network HTTP Compatibility Mode HTTP/1.1 as an extra test.

Applies to Windows, Mac, Desktop

Device notes

Windows
Corporate Windows images with Zscaler-style or PromptSecurity-style SSL inspection are common for this string. Prefer Trusted Root install plus System Certificates V2.
Mac
Same System Certificates V2 leftover applies. Use a full quit after changing certificate settings.
Desktop
Network Diagnostics SSL warnings that name an unrecognized CA are the usual companion to this fingerprint.

Official information

Checked on 8 September 2026, Cursor staff replies on forum threads that quote unable to verify the first certificate describe SSL interception and recommend Http: System Certificates, Http > Experimental: System Certificates V2, trusting the corporate root CA, and only later HTTP/1.1. There is no separate Help Center article that names only this exact internal string.

Sources

Keep troubleshooting

Related problems