Repository navigation
macOS desktop app fails to connect to servers using a trusted private CA #1009
Description
Description
The ZenNotes macOS desktop app fails to connect to a self-hosted ZenNotes server using HTTPS with a certificate issued by a private CA (step-ca), despite the CA being trusted by macOS.
The connection fails with:
Error invoking remote method 'workspace:connect-remote':
Could not reach the server: fetch failed.
Local Network permission is enabled for ZenNotes under macOS Privacy & Security.
Workaround
Completely quitting ZenNotes and launching it with the following environment variable resolves the issue:
NODE_USE_SYSTEM_CA=1 /Applications/ZenNotes.app/Contents/MacOS/ZenNotesThe desktop app then connects successfully without any server-side changes.
Expected behavior
The desktop app should honor certificates trusted by the macOS system trust store without requiring additional environment variables.
Suggested solution
Could ZenNotes enable Node.js system CA trust by default on macOS, or otherwise integrate with the system trust store for remote server connections?
Related
#481 addressed macOS Local Network permissions, but this appears to be a separate certificate trust issue.
Activity
Fix(remote): a server whose certificate a private CA signed connects …
adibhanna commentedon Oct 29, 2026
Thank you for the precise report, and for the
NODE_USE_SYSTEM_CA=1workaround, which pointed straight at the cause.The window trusts the macOS keychain through Chromium, but connecting to a self-hosted server goes through Node's TLS in the main process (and in the MCP server), which only trusts the list bundled into Node. ZenNotes 2.79.0 adds the system store's certificates to that list, once and off the startup path, so a server whose certificate comes from a private CA your Mac trusts connects with no environment variable (cefd86d). I checked it in the built app against a root that only the macOS store has: before the change the request failed with
SELF_SIGNED_CERT_IN_CHAIN, after it the server answered.If you can confirm it against your step-ca server once 2.79.0 is out, that would be great. And thanks again for the Android fix in ZenNotes/zennotesandroid#141, which ships in Android 1.1.50.
lewxdev commentedon Oct 29, 2026
@adibhanna I can confirm the fix works in the latest 2.79.0 release, thanks!