Codex Desktop in-app browser has no bypass for ERR_CERT_AUTHORITY_INVALID on HTTPS localhost

What issue are you seeing?

Codex Desktop's in-app browser blocks HTTPS localhost development servers that use a self-signed or otherwise locally untrusted certificate with ERR_CERT_AUTHORITY_INVALID, but the browser UI does not provide a way to accept the risk and continue.

In a normal Chrome/Chromium browser, this flow exposes an "Advanced" / "Proceed" bypass for a local development origin. In Codex's in-app browser, there is no equivalent button, so HTTPS-only local apps cannot be inspected or driven from Codex even though the same URL is usable in a regular browser after accepting the warning.

This is especially painful for local apps that intentionally require HTTPS during development, for example because they depend on secure cookies, OAuth callbacks, secure-context APIs, service workers, WebRTC, or production-like TLS behavior. For these cases, switching to HTTP is not a valid workaround, and requiring every project/user to install a local CA such as mkcert is not always acceptable.

Steps to reproduce

1. Start a local development server that only serves HTTPS on localhost, using a self-signed or locally untrusted certificate.
2. Open the URL in Codex Desktop's in-app browser, for example https://localhost:3000.
3. Observe ERR_CERT_AUTHORITY_INVALID.
4. Look for the usual browser escape hatch to proceed anyway.

Expected behavior

Codex Desktop should provide a local-development certificate bypass for the in-app browser, for example one of:

• an "Advanced" / "Proceed to localhost (unsafe)" button on the certificate error page;
• a per-origin trust override scoped to the current Codex browser profile;
• a Codex setting / launch option equivalent to Chromium's --allow-insecure-localhost or --ignore-certificate-errors, ideally scoped to localhost/private origins rather than globally;
• a prompt that lets the user explicitly allow this specific localhost origin for the current session.

Actual behavior

The in-app browser stops at ERR_CERT_AUTHORITY_INVALID and does not expose a visible way to proceed. As a result, Codex cannot use the built-in browser for HTTPS-only localhost apps.

Platform

• Codex Desktop app / in-app browser
• macOS 15.7.3, arm64
• Local URL: HTTPS localhost

I could not get a reliable Codex CLI version locally because codex --version fails in this environment with an ENOENT for the bundled vendor binary, but this report is about the Desktop in-app browser UI rather than the CLI.

Additional context

This is a feature request / bug for developer ergonomics. The requested behavior should be explicitly user-driven and scoped, not silently disabling TLS validation for arbitrary public websites.

open -a Codex --args --allow-insecure-localhost