Repository navigation
Unable to get issuer certificate” / AggregateError: Failed to list models on macOS #1104
Description
Describe the bug
On macOS (Apple Silicon, macOS 15.x), Prompting in Copilot CLI fails with:
[ERROR] Error making GitHub API request: Error: unable to get issuer certificate; … [DEBUG] Failed to fetch models from https://api.*.githubcopilot.com: TypeError: fetch failed AggregateError: Failed to list models
even though:
• no proxy / VPN / firewall is active
• no TLS or proxy environment variables are set
• curl and standalone node fetch() work correctly
The failure appears to be specific to the embedded Node runtime used by Copilot CLI when validating the certificate chain for api.individual.githubcopilot.com.
Affected version
0.0.394 Commit: 3d79feb
Steps to reproduce the behavior
- Install Copilot CLI on macOS (Apple Silicon, macOS 15.x)
- Run: 'copilot --log-level debug'
- Observe repeated errors: 'Error making GitHub API request: Error: unable to get issuer certificate
Failed to fetch models from https://api.individual.githubcopilot.com
AggregateError: Failed to list models'
Diagnostics that succeed:
'node -e "fetch('https://api.individual.githubcopilot.com/mcp/readonly')"
returns 401 (expected without auth)'
Certificate chain verified with:
'openssl s_client -showcerts -connect api.individual.githubcopilot.com:443'
Chain:
'*.individual.githubcopilot.com
→ Sectigo RSA Domain Validation Secure Server CA
→ USERTrust RSA Certification Authority
→ AAA Certificate Services'
Expected behavior
Expected behavior
Copilot CLI should successfully connect to the Copilot API and list available models on a clean macOS system with valid public certificates, without requiring manual Keychain trust changes.
Additional context
Workaround:
Setting AAA Certificate Services to Always Trust in Keychain Access fixes the issue:
1. Keychain Access → System Roots
2. Find AAA Certificate Services
3. Set Trust → Always Trust
4. Reboot
5. Copilot CLI works correcly now
6. Set Trust back to "Use System Defaults" + reboot -> Issue does not reappear.
This suggests a trust-store mismatch between macOS and the embedded Node runtime used by Copilot CLI.
Related issue: #333 (certificate trust handling)
Related issue2:
Recent macOS embedded Node TLS trust issue reported in VS Code Remote:
microsoft/vscode-remote-release#11425
(same “AAA Certificate Services” root trust workaround fixes the problem).
Environment
• Operating system: macOS Sequoia 15.x
• CPU architecture: ARM (Apple Silicon)
• Copilot CLI: 0.0.394
• Embedded Node: v24.11.1
• Terminal: Apple Terminal
• Shell: zsh
Logs were captured using:
copilot --log-level debug --log-dir ./copilot-logs
Activity
NITHESH2303 commentedon Feb 21, 2026
Adding another reproducible data point (macOS, Copilot CLI 0.0.414):
Environment:
What I see:
copilot -p "say ok" -s --allow-all-toolsexits with code 1 and no responseFailed to fetch models from https://api.business.githubcopilot.com: TypeError: fetch failedthenError loading models: Error: Failed to list modelsError making GitHub API request: Error: unable to get issuer certificateChecks performed:
copilot login)curl -I https://api.business.githubcopilot.comreaches endpointcurl -i https://api.business.githubcopilot.com/mcp/readonlyreturns expected 401 without authnode -e "fetch("https://api.business.githubcopilot.com").then(r=>console.log(r.status))"=> 404This still points to Copilot CLI internal fetch/model-list path rather than account/login setup.
copilot-cli-bot commentedon Sep 22, 2026
This appears to be resolved as of GitHub Copilot CLI v1.0.87. Please update to that release or a newer stable version. We're closing this as completed. If it still happens, please comment with your version and reproduction steps.