Describe the feature or problem you'd like to solve
trust/skip TLS verification for MCP HTTP servers with invalid SAN certs (rustls hard-fails, no insecure option)
Proposed solution
Copilot CLI cannot connect to a remote HTTP MCP server whose TLS certificate has an invalid Subject Alternative Name (e.g., a literal * instead of a proper wildcard/IP SAN), even after the cert's issuing CA is explicitly trusted. There is no config option or environment variable to bypass hostname/certificate verification for a specific MCP server, which blocks use cases like connecting to on-prem/IoT devices with embedded mcp server and self-managed certificates addressed by IP Address.
Steps to reproduce
- device that presents a self-signed certificate whose Subject/SAN is not a valid match for the IP address (e.g., CN/SAN = * )
- Export and trust the CA: export NODE_EXTRA_CA_CERTS=~/ctrlx.pem
- Run copilot , then /mcp — the server still fails to connect.
Requested behavior
The CLI offers a supported way to relax verification for a specific MCP server (e.g., a per-server tls.insecureSkipVerify or honoring a documented env var), similar to how curl -k or Node's NODE_TLS_REJECT_UNAUTHORIZED=0 work for other tools.
Example prompts or workflows
NA
Additional context
• Related: #4364 documents a similar underlying issue (rustls/rustls-platform-verifier being stricter than curl/Node/Chrome for enterprise MCP registry TLS), suggesting this is a broader gap in the Rust-based MCP networking layer, not specific to one code path.
• For comparison, Claude Code and Gemini CLI's MCP clients run on Node.js, so NODE_TLS_REJECT_UNAUTHORIZED=0 works as an (insecure) escape hatch there; Copilot CLI has no equivalent because of the runtime split.
• Use case: connecting to on-prem/IoT devices reachable only via IP address with vendor-managed self-signed certificates that can't easily be reissued with a proper SAN.
Describe the feature or problem you'd like to solve
trust/skip TLS verification for MCP HTTP servers with invalid SAN certs (rustls hard-fails, no insecure option)
Proposed solution
Copilot CLI cannot connect to a remote HTTP MCP server whose TLS certificate has an invalid Subject Alternative Name (e.g., a literal * instead of a proper wildcard/IP SAN), even after the cert's issuing CA is explicitly trusted. There is no config option or environment variable to bypass hostname/certificate verification for a specific MCP server, which blocks use cases like connecting to on-prem/IoT devices with embedded mcp server and self-managed certificates addressed by IP Address.
Steps to reproduce
Requested behavior
The CLI offers a supported way to relax verification for a specific MCP server (e.g., a per-server tls.insecureSkipVerify or honoring a documented env var), similar to how curl -k or Node's NODE_TLS_REJECT_UNAUTHORIZED=0 work for other tools.
Example prompts or workflows
NA
Additional context
• Related: #4364 documents a similar underlying issue (rustls/rustls-platform-verifier being stricter than curl/Node/Chrome for enterprise MCP registry TLS), suggesting this is a broader gap in the Rust-based MCP networking layer, not specific to one code path.
• For comparison, Claude Code and Gemini CLI's MCP clients run on Node.js, so NODE_TLS_REJECT_UNAUTHORIZED=0 works as an (insecure) escape hatch there; Copilot CLI has no equivalent because of the runtime split.
• Use case: connecting to on-prem/IoT devices reachable only via IP address with vendor-managed self-signed certificates that can't easily be reissued with a proper SAN.