[ENHANCEMENT] MCP server using self or internal CA signed certificate cannot be used

[makandre]

Problem (one or two sentences)

It's possible for MCP servers to be using self-signed, or in corporate environment, an internal CA-signed certificate. There isn't any way to specify trust information to Roo so that it can connect to such servers.

Context (who is affected and when)

Users who wish to use MCP servers using self or internal CA signed certificate

Desired behavior (conceptual, not technical)

There should be a way specify/give Roo the signing certificate and indicate that it is to be trusted. Or an option to indicate a MCP server is to be trusted.

Constraints / preferences (optional)

No response

Request checklist

• I've searched existing Issues and Discussions for duplicates
• This describes a specific problem with clear context and impact

Roo Code Task Links (optional)

No response

Acceptance criteria (optional)

No response

Proposed approach (optional)

No response

Trade-offs / risks (optional)

No response

[roomote]

I'm exploring a potential fix for adding support for MCP servers using self-signed or internal CA-signed certificates. I'll work on implementing a solution that allows users to specify trust information for these certificates.

[hannesrudolph]

@makandre are you interested in implementing this proposed improvement?

[roomote]

I've opened PR #8357 with a solution for this issue: #8357

The implementation adds certificate trust configuration support for MCP servers using HTTPS connections (SSE and StreamableHTTP transports) with the following options:

• allowSelfSigned: Allow self-signed certificates (for development)
• caCertPath: Path to custom CA certificate file (for internal CAs)
• rejectUnauthorized: Control certificate validation (defaults to true for security)

The PR includes comprehensive tests, documentation, and maintains secure defaults. CI checks are currently running. Feedback welcome!

[makandre]

@makandre are you interested in implementing this proposed improvement?

@hannesrudolph Is this even necessary? The bot already has a PR (is this for real?!)