Failed to list available models due to duplicate CA certificates from combined system and bundled certs

[a1mersnow]

Describe the bug

whatever i ask, always show this error

Affected version

0.0.373 Commit: 1f9ed04

Steps to reproduce the behavior

No response

Expected behavior

No response

Additional context

No response

[andyfeller]

Thank you for raising this issue, @a1mersnow 🙇 I'd like your help gathering more information to help me troubleshoot what is going on here and getting you unblocked.

Specifically, I would appreciate you running the following command and sharing 1) the console output and 2) relevant log details around retrieving models:

copilot --log-level all --log-dir copilot-cli-869

[a1mersnow]

2026-01-02T14:08:11.511Z [INFO] Starting Copilot CLI: 0.0.373
Commit: 1f9ed04
2026-01-02T14:08:11.511Z [INFO] Node.js version: v24.11.1
2026-01-02T14:08:11.590Z [INFO] Login status unknown
2026-01-02T14:08:11.593Z [INFO] Remote session access enabled
2026-01-02T14:08:11.593Z [DEBUG] No auth info available, skipping custom agents load
2026-01-02T14:08:11.598Z [INFO] Logged in as user: a1mersnow
2026-01-02T14:08:12.601Z [DEBUG] Fetched Copilot URL for a1mersnow from https://api.github.com/graphql: 200 https://api.individual.githubcopilot.com
2026-01-02T14:08:12.601Z [DEBUG] Creating copilot-client for integration ID copilot-developer-cli with token authentication. User-agent: copilot/0.0.373 (darwin v24.11.1) term/iTerm.app
2026-01-02T14:08:12.649Z [DEBUG] Fetched Copilot URL for a1mersnow from https://api.github.com/graphql: 200 https://api.individual.githubcopilot.com
2026-01-02T14:08:12.649Z [LOG] Starting remote MCP client for github-mcp-server with url: https://api.individual.githubcopilot.com/mcp/readonly
2026-01-02T14:08:12.649Z [LOG] Creating MCP client for github-mcp-server...
2026-01-02T14:08:12.652Z [LOG] Connecting MCP client for github-mcp-server...
2026-01-02T14:08:13.494Z [LOG] MCP transport for github-mcp-server closed
2026-01-02T14:08:13.494Z [ERROR] Failed to start MCP client for remote server github-mcp-server: TypeError: fetch failed
2026-01-02T14:08:13.495Z [LOG] GitHub MCP server configured after authentication
2026-01-02T14:08:16.957Z [INFO] No update needed, current version is 0.0.373, fetched latest release is v0.0.373
2026-01-02T14:08:21.471Z [DEBUG] Detected mentions: 
2026-01-02T14:08:22.156Z [DEBUG] Fetched Copilot URL for a1mersnow from https://api.github.com/graphql: 200 https://api.individual.githubcopilot.com
2026-01-02T14:08:22.645Z [DEBUG] Fetched Copilot URL for a1mersnow from https://api.github.com/graphql: 200 https://api.individual.githubcopilot.com
2026-01-02T14:08:22.645Z [DEBUG] Creating copilot-client for integration ID copilot-developer-cli with token authentication. User-agent: copilot/0.0.373 (darwin v24.11.1) term/iTerm.app
2026-01-02T14:08:24.989Z [DEBUG] Detected mentions: 
2026-01-02T14:08:25.472Z [DEBUG] Fetched Copilot URL for a1mersnow from https://api.github.com/graphql: 200 https://api.individual.githubcopilot.com
2026-01-02T14:08:25.472Z [DEBUG] Creating copilot-client for integration ID copilot-developer-cli with token authentication. User-agent: copilot/0.0.373 (darwin v24.11.1) term/iTerm.app

[a1mersnow]

It seems to be a problem with the network. I don't know...

[JohnnyVicious]

Had the same message for a short while today, guessing it is GH API related

[a1mersnow]

It's weird! When I set the proxy to a MitmProxy (I want to intercept and debug the request), it works!

[andyfeller]

It's weird! When I set the proxy to a MitmProxy (I want to intercept and debug the request), it works!

Thanks for the additional details, @a1mersnow 🤔 Are you using copilot on a corporate network or VPN that has proxying requirements or perhaps is blocking Copilot Individual subscriptions?

At the least, this highlights an opportunity to improve the error messaging and logging when unable to make HTTP connections for GitHub MCP server and talking to Copilot API.

In the mean time, NODE_DEBUG=http,https,undici copilot should provide lower-level HTTP logs. I'd be interested if any connections are being refused or if there is something else going on.

Expand for snippet from my copilot logs for comparison

2026-01-05T13:33:28.041Z [INFO] Starting Copilot CLI: 0.0.374
Commit: 9fecd24
2026-01-05T13:33:28.041Z [INFO] Node.js version: v24.11.1
2026-01-05T13:33:28.284Z [INFO] Login status unknown
2026-01-05T13:33:28.287Z [INFO] Remote session access enabled
2026-01-05T13:33:28.287Z [DEBUG] No auth info available, skipping custom agents load
2026-01-05T13:33:28.294Z [INFO] Logged in as user: andyfeller
2026-01-05T13:33:28.657Z [DEBUG] Fetched Copilot URL for andyfeller from https://api.github.com/graphql: 200 https://api.enterprise.githubcopilot.com
2026-01-05T13:33:28.680Z [DEBUG] Fetched Copilot URL for andyfeller from https://api.github.com/graphql: 200 https://api.enterprise.githubcopilot.com
2026-01-05T13:33:28.680Z [DEBUG] Creating copilot-client for integration ID copilot-developer-cli with token authentication. User-agent: copilot/0.0.374 (darwin v24.11.1) term/Apple_Terminal
2026-01-05T13:33:28.785Z [DEBUG] Successfully listed 33 models
2026-01-05T13:33:28.921Z [DEBUG] Fetched Copilot URL for andyfeller from https://api.github.com/graphql: 200 https://api.enterprise.githubcopilot.com
2026-01-05T13:33:28.921Z [DEBUG] Creating copilot-client for integration ID copilot-developer-cli with token authentication. User-agent: copilot/0.0.374 (darwin v24.11.1) term/Apple_Terminal
2026-01-05T13:33:28.958Z [DEBUG] Successfully listed 33 models
2026-01-05T13:33:28.991Z [DEBUG] Fetched Copilot URL for andyfeller from https://api.github.com/graphql: 200 https://api.enterprise.githubcopilot.com
2026-01-05T13:33:28.991Z [LOG] Starting remote MCP client for github-mcp-server with url: https://api.enterprise.githubcopilot.com/mcp/readonly
2026-01-05T13:33:28.991Z [LOG] Creating MCP client for github-mcp-server...
2026-01-05T13:33:28.991Z [LOG] Connecting MCP client for github-mcp-server...
2026-01-05T13:33:29.012Z [DEBUG] str_replace_editor: default options: {
  "truncateBasedOn": "tokenCount",
  "truncateStyle": "middle"
}
2026-01-05T13:33:29.125Z [LOG] MCP client for github-mcp-server connected, took 134ms
2026-01-05T13:33:29.125Z [LOG] Started MCP client for remote server github-mcp-server
2026-01-05T13:33:29.125Z [LOG] GitHub MCP server configured after authentication
2026-01-05T13:33:29.182Z [DEBUG] Loading tools for client: github-mcp-server
2026-01-05T13:33:29.259Z [DEBUG] Adding tool: github-mcp-server-actions_get
2026-01-05T13:33:29.259Z [DEBUG] Adding tool: github-mcp-server-actions_list
2026-01-05T13:33:29.259Z [DEBUG] Skipping tool get_code_scanning_alert for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-get_commit
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-get_copilot_space
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-get_file_contents
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-get_job_logs
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool get_label for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool get_latest_release for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool get_release_by_tag for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool get_secret_scanning_alert for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool get_tag for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-issue_read
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-list_branches
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool list_code_scanning_alerts for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-list_commits
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool list_copilot_spaces for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool list_issue_types for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-list_issues
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-list_pull_requests
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool list_releases for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool list_secret_scanning_alerts for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Skipping tool list_tags for client github-mcp-server
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-pull_request_read
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-search_code
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-search_issues
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-search_pull_requests
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-search_repositories
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-search_users
2026-01-05T13:33:29.260Z [DEBUG] Adding tool: github-mcp-server-web_search
2026-01-05T13:33:29.260Z [DEBUG] str_replace_editor: default options: {
  "truncateBasedOn": "tokenCount",
  "truncateStyle": "middle"
}
2026-01-05T13:33:33.162Z [INFO] No update needed, current version is 0.0.374, fetched latest release is v0.0.374
2026-01-05T13:33:34.637Z [DEBUG] Detected mentions: 
2026-01-05T13:33:34.639Z [DEBUG] str_replace_editor: default options: {
  "truncateBasedOn": "tokenCount",
  "truncateStyle": "middle"
}
2026-01-05T13:33:34.639Z [INFO]  
2026-01-05T13:33:34.639Z [DEBUG] Using model: claude-sonnet-4.5

[lvitaly]

@andyfeller, here is what I have 🙂 if I run NODE_DEBUG=http,https,undici copilot --log-level all --log-dir copilot-cli-869

Copilot logs

2026-01-05T15:50:47.339Z [INFO] Starting Copilot CLI: 0.0.373
Commit: 1f9ed04
2026-01-05T15:50:47.339Z [INFO] Node.js version: v24.12.0
2026-01-05T15:50:47.420Z [INFO] Login status unknown
2026-01-05T15:50:47.450Z [INFO] Remote session access enabled
2026-01-05T15:50:47.450Z [DEBUG] No auth info available, skipping custom agents load
2026-01-05T15:50:47.451Z [ERROR] Error checking for updates: TypeError: Cannot read properties of undefined (reading 'paths')
2026-01-05T15:50:47.455Z [INFO] Logged in as user: lvitaly
2026-01-05T15:50:47.856Z [DEBUG] Fetched Copilot URL for lvitaly from https://api.github.com/graphql: 200 https://api.individual.githubcopilot.com
2026-01-05T15:50:47.857Z [DEBUG] Creating copilot-client for integration ID copilot-developer-cli with token authentication. User-agent: copilot/0.0.373 (darwin v24.12.0) term/iTerm.app
2026-01-05T15:50:47.869Z [DEBUG] Fetched Copilot URL for lvitaly from https://api.github.com/graphql: 200 https://api.individual.githubcopilot.com
2026-01-05T15:50:47.870Z [LOG] Starting remote MCP client for github-mcp-server with url: https://api.individual.githubcopilot.com/mcp/readonly
2026-01-05T15:50:47.870Z [LOG] Creating MCP client for github-mcp-server...
2026-01-05T15:50:47.874Z [LOG] Connecting MCP client for github-mcp-server...
2026-01-05T15:50:48.150Z [LOG] MCP transport for github-mcp-server closed
2026-01-05T15:50:48.150Z [ERROR] Failed to start MCP client for remote server github-mcp-server: TypeError: fetch failed
2026-01-05T15:50:48.150Z [LOG] GitHub MCP server configured after authentication

UNDICI logs

UNDICI 34548: connected to api.github.com using https:h2
UNDICI 34548: connected to api.github.com using https:h2
UNDICI 34548: sending request to POST https://api.github.com/graphql
UNDICI 34548: sending request to POST https://api.github.com/graphql
UNDICI 34548: connected to api.github.com using https:h2
UNDICI 34548: connected to api.github.com using https:h2
UNDICI 34548: sending request to POST https://api.github.com/graphql
UNDICI 34548: sending request to POST https://api.github.com/graphql
UNDICI 34548: connected to api.github.com using https:h2
UNDICI 34548: connected to api.github.com using https:h2
UNDICI 34548: sending request to POST https://api.github.com/graphql
UNDICI 34548: sending request to POST https://api.github.com/graphql
UNDICI 34548: received response to POST https://api.github.com/graphql - HTTP 200
UNDICI 34548: received response to POST https://api.github.com/graphql - HTTP 200
UNDICI 34548: trailers received from POST https://api.github.com/graphql
UNDICI 34548: trailers received from POST https://api.github.com/graphql
UNDICI 34548: received response to POST https://api.github.com/graphql - HTTP 200
UNDICI 34548: received response to POST https://api.github.com/graphql - HTTP 200
UNDICI 34548: trailers received from POST https://api.github.com/graphql
UNDICI 34548: trailers received from POST https://api.github.com/graphql
UNDICI 34548: connecting to api.individual.githubcopilot.com using https:undefined
UNDICI 34548: connecting to api.individual.githubcopilot.com using https:undefined
UNDICI 34548: received response to POST https://api.github.com/graphql - HTTP 200
UNDICI 34548: received response to POST https://api.github.com/graphql - HTTP 200
UNDICI 34548: trailers received from POST https://api.github.com/graphql
UNDICI 34548: trailers received from POST https://api.github.com/graphql
UNDICI 34548: connecting to api.individual.githubcopilot.com using https:undefined
UNDICI 34548: connecting to api.individual.githubcopilot.com using https:undefined
UNDICI 34548: connection to api.individual.githubcopilot.com using https:undefined errored - unable to get issuer certificate; if the root CA is installed locally, try running Node.js with --use-system-ca
UNDICI 34548: connection to api.individual.githubcopilot.com using https:undefined errored - unable to get issuer certificate; if the root CA is installed locally, try running Node.js with --use-system-ca

[lvitaly]

And I don't have connectivity issues (vpn, proxy). Get a pretty valid response in curl.

curl -v https://api.individual.githubcopilot.com/mcp/readonly

* Host api.individual.githubcopilot.com:443 was resolved.
* IPv6: (none)
* IPv4: 140.82.114.22
*   Trying 140.82.114.22:443...
* Connected to api.individual.githubcopilot.com (140.82.114.22) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=*.individual.githubcopilot.com
*  start date: Apr  8 00:00:00 2025 GMT
*  expire date: Apr  8 23:59:59 2026 GMT
*  subjectAltName: host "api.individual.githubcopilot.com" matched cert's "*.individual.githubcopilot.com"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://api.individual.githubcopilot.com/mcp/readonly
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: api.individual.githubcopilot.com]
* [HTTP/2] [1] [:path: /mcp/readonly]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET /mcp/readonly HTTP/2
> Host: api.individual.githubcopilot.com
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/2 401
< content-security-policy: default-src 'none'; sandbox
< content-type: text/plain; charset=utf-8
< strict-transport-security: max-age=31536000
< www-authenticate: Bearer error="invalid_request", error_description="No access token was provided in this request", resource_metadata="https://api.githubcopilot.com/.well-known/oauth-protected-resource/mcp/readonly"
< x-content-type-options: nosniff
< date: Mon, 05 Jan 2026 16:21:00 GMT
< content-length: 51
< x-github-backend: Kubernetes
< x-github-request-id: EB47:C3621:53BDD9:5F5945:695BE4EC
<
bad request: missing required Authorization header
* Connection #0 to host api.individual.githubcopilot.com left intact

[paolomainardi]

I am having the very same issue, at first i thought that was something related to MDM or some ssl/proxy intercepts, but nothing on the system is doing that.

The issue was introduced in version 0.0.370. Version 0.0.369 works, 0.0.370 and later fail.

The key difference: up to 0.0.369, the CLI prompted for keychain access to read certificates from the macOS login keychain.

Starting from 0.0.370, this prompt no longer appears and the CLI fails to validate the certificate chain for api.business.githubcopilot.com.

0.0.369 works (prompts for keychain access):

$ NODE_DEBUG=undici npx @github/copilot@0.0.369 -p "hello world"
UNDICI: connected to api.business.githubcopilot.com using https:h2
UNDICI: received response to GET https://api.business.githubcopilot.com/models - HTTP 200
UNDICI: received response to POST https://api.business.githubcopilot.com/chat/completions - HTTP 200

0.0.370 fails (no keychain prompt):

$ NODE_DEBUG=undici npx @github/copilot@0.0.370 -p "hello world"
UNDICI: connected to api.github.com using https:h2
UNDICI: received response to POST https://api.github.com/graphql - HTTP 200
UNDICI: connection to api.business.githubcopilot.com errored - unable to get issuer certificate

Requests to api.github.com succeed but api.business.githubcopilot.com fails. They use different intermediate CAs:

• api.github.com - Sectigo ECC (works)
• api.business.githubcopilot.com - Sectigo RSA (fails)

Both are legitimate certs, same root CA (AAA Certificate Services). curl and openssl validate them fine.

Environment:

• macOS 15.x
• No proxy, no VPN, no SSL inspection

Workaround:

mkdir -p ~/.ssl
security find-certificate -a -p /Library/Keychains/System.keychain > ~/.ssl/ca-bundle.pem
security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain >> ~/.ssl/ca-bundle.pem
export NODE_EXTRA_CA_CERTS="$HOME/.ssl/ca-bundle.pem"

Looks like something changed in 0.0.370 that removed or broke the keychain integration on macOS.

[andyfeller]

@andyfeller, here is what I have 🙂 if I run NODE_DEBUG=http,https,undici copilot --log-level all --log-dir copilot-cli-869

@lvitaly : The most interesting log events are the following:

UNDICI 34548: connection to api.individual.githubcopilot.com using https:undefined errored - unable to get issuer certificate; if the root CA is installed locally, try running Node.js with --use-system-ca
UNDICI 34548: connection to api.individual.githubcopilot.com using https:undefined errored - unable to get issuer certificate; if the root CA is installed locally, try running Node.js with --use-system-ca

I know 0.0.370 shipped support for loading CA certificates from system and environment variables (NODE_EXTRA_CA_CERTS, SSL_CERT_FILE, CURL_CA_BUNDLE) so I would expect copilot to just pick up on them though I believe #333 touches on some places on Mac OS that could also contain certificates.

And I don't have connectivity issues (vpn, proxy). Get a pretty valid response in curl.

curl -v https://api.individual.githubcopilot.com/mcp/readonly

For testing SSL/TLS connectivity, I like running openssl s_client -connect api.individual.githubcopilot.com:443; see below for example

Expand for openssl s_client example

$ openssl s_client -connect api.individual.githubcopilot.com:443
Connecting to 140.82.114.21
CONNECTED(00000005)
depth=2 C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
verify return:1
depth=1 C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
verify return:1
depth=0 CN=*.individual.githubcopilot.com
verify return:1
---
Certificate chain
 0 s:CN=*.individual.githubcopilot.com
   i:C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
   a:PKEY: RSA, 4096 (bit); sigalg: sha256WithRSAEncryption
   v:NotBefore: Apr  8 00:00:00 2025 GMT; NotAfter: Apr  8 23:59:59 2026 GMT
 1 s:C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
   i:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
   a:PKEY: RSA, 2048 (bit); sigalg: sha384WithRSAEncryption
   v:NotBefore: Nov  2 00:00:00 2018 GMT; NotAfter: Dec 31 23:59:59 2030 GMT
 2 s:C=US, ST=New Jersey, L=Jersey City, O=The USERTRUST Network, CN=USERTrust RSA Certification Authority
   i:C=GB, ST=Greater Manchester, L=Salford, O=Comodo CA Limited, CN=AAA Certificate Services
   a:PKEY: RSA, 4096 (bit); sigalg: sha384WithRSAEncryption
   v:NotBefore: Mar 12 00:00:00 2019 GMT; NotAfter: Dec 31 23:59:59 2028 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIHZDCCBkygAwIBAgIRAPhEj0GyA9x6QG+9Zm3PufgwDQYJKoZIhvcNAQELBQAw
gY8xCzAJBgNVBAYTAkdCMRswGQYDVQQIExJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAO
BgNVBAcTB1NhbGZvcmQxGDAWBgNVBAoTD1NlY3RpZ28gTGltaXRlZDE3MDUGA1UE
AxMuU2VjdGlnbyBSU0EgRG9tYWluIFZhbGlkYXRpb24gU2VjdXJlIFNlcnZlciBD
QTAeFw0yNTA0MDgwMDAwMDBaFw0yNjA0MDgyMzU5NTlaMCkxJzAlBgNVBAMMHiou
aW5kaXZpZHVhbC5naXRodWJjb3BpbG90LmNvbTCCAiIwDQYJKoZIhvcNAQEBBQAD
ggIPADCCAgoCggIBAL8JeGnE87ql2LpEVExd3sKZBUDmIxMUCBZj9QTEXXMZxELM
s5KOnRJ+tJLDWLh3fARdKrwEEtJWV7U/UxWTH1ItSgyhw5SeV9Ch6NbuEEgpmwtv
g/j168If2p5FXydlWPkSQh1nV4VwSBs/mTYHZbi9PgmczA6v90swioisw+6rTUsz
mgnbqM37XEI4BFUch2PyVTf91sRVzJDBwwNfIYseUqwUOOeg420VuXpcgugVd0YK
RUwoTkgxh4KOIKYJKko39KQKD9JHoIzIKDoy9dux/g7KdKYXwO9GQPuR+SpyhfIi
p0+AF0dMg5vBuL3+fqrE8Y0DT5Tjqk5If9bL9CGSwPrRb17WNHjzMcajzdLvmMwA
q7IpG/Bmj4CldJQib8Mt4GFa+g29Cv2POUufcqJPrhJ47zlVio2Wip/3fxvMT8zm
27s5BMJBdPgxVW1KHiNecWQ8t+28/1uixd2IbT96QpV8aC5Bz0TW0xAG5suGEhIF
1bk8tUKlwSvy8jYEBOXfpVF7OO3MPkV1UoLCOsxcTqrrpT+FRW0OmCvYXQ5w2JBs
AW/VwLyMviIn8SxUf1FabQ21h+M8mEru+5XeaRwJJz3O8tpex4k6jSnV0UUx10T1
wnyqcJdBjQ0Daed72QaYSR7sVyK/+7Sgj+0q7B70RguyIqsTdxTYBaCCrvo/AgMB
AAGjggMeMIIDGjAfBgNVHSMEGDAWgBSNjF7EVK2K4Xfpm/mbBeG4AY1h4TAdBgNV
HQ4EFgQUfUwZLP0Nfd+xor8zgrecSW7tipEwDgYDVR0PAQH/BAQDAgWgMAwGA1Ud
EwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMEkGA1UdIARC
MEAwNAYLKwYBBAGyMQECAgcwJTAjBggrBgEFBQcCARYXaHR0cHM6Ly9zZWN0aWdv
LmNvbS9DUFMwCAYGZ4EMAQIBMIGEBggrBgEFBQcBAQR4MHYwTwYIKwYBBQUHMAKG
Q2h0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1JTQURvbWFpblZhbGlkYXRp
b25TZWN1cmVTZXJ2ZXJDQS5jcnQwIwYIKwYBBQUHMAGGF2h0dHA6Ly9vY3NwLnNl
Y3RpZ28uY29tMIIBfgYKKwYBBAHWeQIEAgSCAW4EggFqAWgAdgCWl2S/VViXrfdD
h2g3CEJ36fA61fak8zZuRqQ/D8qpxgAAAZYStGMRAAAEAwBHMEUCIQDaIEI8ybEn
vd8jApmI5lU1+qVc+v8OacqPQ75ssfVEHgIgVGYROTWoafP7JeR83aEWEAW1XMRm
7fGMFgFNipnsQrcAdgAZhtTHKKpv/roDb3gqTQGRqs4tcjEPrs5dcEEtJUzH1AAA
AZYStGKkAAAEAwBHMEUCIQCFGXrwpnX2ZGSPdL+6WaWoQk1G7miuf7p/QTEGipLD
ewIgfkC5kA+f8gAmGvs3yTD1Vcjb6Jg3Mz8QbWR/xpPSJ5gAdgAOV5S8866pPjMb
LJkHs/eQ35vCPXEyJd0hqSWsYcVOIQAAAZYStGKlAAAEAwBHMEUCIQClkM9bh3tj
kv0ilqOGy+FwdhHAZDovhlJq7V2vvRd1ggIgJJrlM8azyFrbdvr/gzea7aoWbd/O
SZLMURRIB3+MZrAwRwYDVR0RBEAwPoIeKi5pbmRpdmlkdWFsLmdpdGh1YmNvcGls
b3QuY29tghxpbmRpdmlkdWFsLmdpdGh1YmNvcGlsb3QuY29tMA0GCSqGSIb3DQEB
CwUAA4IBAQB5o6/7HSqflCyD88x8h9FcCYAYiic8gm4pTX4ucv6zP4LP9CHtxWCN
s7b1SwZEh83Xb3huOXPCZpwWt6JEmkQdEegcNpFET0jTTJf/FbCIRY3uIw/mSRxk
mZfqN1N3VJPcGPGiqmmZz2t33DAIQeYsDOzUVIZw2cHM1pjLVgIyUuGJCGURPyf/
86CqjNt3D3abuJ6OV9ywcqS4SXObcWosXFKa6B2dQ8RSmWdWc/4GgIj+q4ZPOBu1
Es00WQqMmUKyemdyTE9XBmhAnERHBMaABmtCWIzt0V/SQTfHBXPehFG4b8cJssc7
jrwIwjDE5R63VA4a+cwejqG0cy/K/OvZ
-----END CERTIFICATE-----
subject=CN=*.individual.githubcopilot.com
issuer=C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: rsa_pss_rsae_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 5678 bytes and written 1629 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Protocol: TLSv1.3
Server public key is 4096 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_128_GCM_SHA256
    Session-ID: 5DBFF18D601C9F6311221B357418A8E0A40E87E1DF850A3E7602B6B3B486A7D1
    Session-ID-ctx: 
    Resumption PSK: A4811E0D9BD85BD7B21F74E7498E8AB56EAE8CC6208487E2E3823ED79363D577
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - 73 20 ba 1e df b4 ac c7-fd 93 aa 0c cb fe c9 91   s ..............
    0010 - 8d 6d 90 05 ec 9b c1 53-fc 30 d7 9d db 34 96 8a   .m.....S.0...4..

    Start Time: 1767645314
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_128_GCM_SHA256
    Session-ID: 7EA9CBEC021745041C4EBDC8C48A51679CDBF7883C090F1801F49AAF70A051A5
    Session-ID-ctx: 
    Resumption PSK: 7F12DDF9D99B7371B4D7E1707EF6A394695428FFAA236807FACA7C96E3F49C6A
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 7200 (seconds)
    TLS session ticket:
    0000 - b6 66 0a 38 54 d2 bb b0-93 01 cb b4 e4 8f 88 4c   .f.8T..........L
    0010 - 43 32 9f 7e 4a 7c 59 e3-b2 7d b2 36 11 52 67 22   C2.~J|Y..}.6.Rg"

    Start Time: 1767645314
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK