OAuth Login Fails Behind Corporate Proxy with Custom CA Certificates

What version of Codex is running?

0.58.0

What subscription do you have?

Bussiness

Which model were you using?

gpt-5.1-codex

What platform is your computer?

Darwin 23.6.0 arm64 arm

What issue are you seeing?

Summary

The Codex CLI fails to authenticate when running behind a corporate proxy that performs SSL/TLS inspection with custom CA certificates. The OAuth token exchange fails with the error:

Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

Environment

• OS: macOS (Darwin 23.6.0)
• Codex CLI Version: 0.58.0

Problem Description

The Codex CLI OAuth login flow fails at the token exchange step when the user is behind a corporate proxy that uses custom SSL certificates for man-in-the-middle inspection (common in enterprise environments).

Authentication Flow

1. User runs codex login
2. Browser opens and user completes OAuth authorization ✅
3. Browser redirects to http://localhost:1455/auth/callback?code=... ✅
4. Local server receives the authorization code ✅
5. Server attempts to exchange code for tokens via POST to https://auth.openai.com/oauth/token ❌
6. Request fails because reqwest::Client doesn't trust the corporate CA certificate

Root Cause

In codex-rs/login/src/server.rs, the exchange_code_for_tokens (line 508) and obtain_api_key (line 698) functions use reqwest::Client::new(), which creates an HTTP client with only the system's default certificate roots.

let client = reqwest::Client::new();  // Does not trust custom CA certificates
let resp = client
    .post(format!("{issuer}/oauth/token"))
    .header("Content-Type", "application/x-www-form-urlencoded")
    .body(...)
    .send()
    .await
    .map_err(io::Error::other)?;  // Fails with SSL certificate verification error

When behind a corporate proxy with SSL inspection:

• The connection to auth.openai.com is intercepted
• The proxy presents a certificate signed by the corporate CA
• reqwest doesn't trust this CA and rejects the connection
• The token exchange fails with a generic "error sending request" message

Steps to Reproduce

1. Configure corporate proxy with SSL inspection
2. Export corporate CA certificates to PEM format
3. Run codex login
4. Complete OAuth flow in browser
5. Observe error: Token exchange failed: error sending request for url (https://auth.openai.com/oauth/token)

Proposed Solution

Add support for custom CA certificates in the OAuth login flow, similar to how it's already implemented for OpenTelemetry exporters in codex-rs/otel/src/otel_provider.rs.

Implementation Approach

1. Add CA certificate configuration to the login module:

``rust
pub struct LoginOptions {
// ... existing fields
pub ca_certificate: Option<PathBuf>,
}
``

1. Create HTTP client with custom CA certificate (similar to otel_provider.rs:185-228):

```rust
fn build_http_client(ca_cert_path: Option<&PathBuf>) -> io::Result<reqwest::Client> {
let mut builder = reqwest::Client::builder();

if let Some(path) = ca_cert_path {
let pem = std::fs::read(path)?;
let certificate = reqwest::Certificate::from_pem(&pem)
.map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))?;
builder = builder.add_root_certificate(certificate);
}

builder.build().map_err(io::Error::other)
}
```

1. Update exchange_code_for_tokens and obtain_api_key to use the custom client:

``rust
let client = build_http_client(opts.ca_certificate.as_ref())?;
``

1. Support environment variable (e.g., CODEX_CA_CERTIFICATE or reuse SSL_CERT_FILE)

1. Support config file via ~/.codex/config.toml:

``toml
[login]
ca_certificate = "~/.certs/corporate-ca.pem"
``

Alternative Solutions

1. Automatic detection: Check for SSL_CERT_FILE environment variable (used by many tools)
2. System keychain: Use platform-specific APIs to load certificates from system trust stores
3. Proxy detection: Auto-detect corporate proxy and prompt user to provide certificate

Related Code

• Working TLS implementation: codex-rs/otel/src/otel_provider.rs:185-228 - Shows how to add custom CA certificates to reqwest::Client
• Affected functions:
• codex-rs/login/src/server.rs:494-536 - exchange_code_for_tokens()
• codex-rs/login/src/server.rs:688-721 - obtain_api_key()
• codex-rs/login/src/device_code_auth.rs:153 - Device code flow

Impact

This affects all Codex CLI users in corporate environments with:

• SSL/TLS inspection proxies (Zscaler, Palo Alto Networks, etc.)
• Custom internal CA certificates
• Air-gapped environments with internal certificate authorities

Workarounds

Currently, users must either:

1. Disable SSL verification (insecure): NODE_TLS_REJECT_UNAUTHORIZED=0 (doesn't help with Rust client)
2. Bypass the proxy for OpenAI domains (may violate corporate policy)
3. Cannot use Codex CLI (blocks adoption in enterprise environments)

References

• OpenAI Platform documentation: https://platform.openai.com/docs
• reqwest custom certificate documentation: https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.add_root_certificate
• Similar issue in other tools that solved this: Rust toolchain, npm, etc.

What steps can reproduce the bug?

Try to login with codex on a machine that is behind corporate proxy with custom certificate

What is the expected behavior?

Exchange token successfully without 500 error

Additional information

_No response_