Bug Internal Error

Support Bug Reports
1

Where does the bug appear (feature/product)?

Cursor IDE
Subs PRO version

Describe the Bug

Having trouble using my cursor keep getting this error please help i am unable to use it because it keeps on discontinuing and giving Internal Error

Windows 11 Enterprise

Request ID: d2406f91-9d7a-454f-b8fa-b2bf3d4482fc
[internal] self signed certificate in certificate chain
RetriableError: [internal] self signed certificate in certificate chain
at uAS (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:12056:27795)
at EMc (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:12056:26530)
at Fny (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:12057:11929)
at Object.classify (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:12057:16434)
at hAS (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:12057:5824)
at async Oqm.runWithSharedTurnRunner (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:12057:15786)
at async iH.resume (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:24486:7475)
at async Lkh.streamFromAgentBackend (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:24505:13862)
at async Lkh.getAgentStreamResponse (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:24505:22888)
at async IRe.submitChatMaybeAbortCurrent (vscode-file://vscode-app/c:/Users/adzulkharnain/AppData/Local/Programs/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js:12142:2399)

Steps to Reproduce

i enter the chat and then it will go to Planning next moves > Reconnecting > Internal Error

sometimes it gives me but it will discontinue and give error

ive tried using AUTO and other AI Agents Bot

Operating System

Other

Version Information

Version: 3.9.16 (user setup)
VS Code Extension API: 1.105.1
Commit: 042b3c1a4c53f2c3808067f519fbfc67b72cad80
Date: 2026-06-27T06:41:01.941Z
Layout: editor
Build Type: Stable
Release Track: Default
Electron: 40.10.3
Chromium: 144.0.7559.236
Node.js: 24.15.0
V8: 14.4.258.32-electron.0
xterm.js: 6.1.0-beta.256
OS: Windows_NT x64 10.0.26100

For AI issues: which model did you use?

AUTO and Sonnet 4.6

Does this stop you from using Cursor

Yes - Cursor is unusable

5

Hey, thanks for the detailed report with the request ID and stack trace. That made it quick to see what’s going on.

The self signed certificate in certificate chain error isn’t coming from Cursor, it’s coming from your corporate network. Windows 11 Enterprise is often set up so a proxy or antivirus like Zscaler or Netskope decrypts HTTPS and re-signs traffic with a corporate self-signed CA. Cursor doesn’t trust that certificate, so the TLS handshake fails, which leads to Reconnecting > Internal Error. From what we can see, your requests were still going through a couple of minutes before your post, and the specific failing request never reached our servers at all. That lines up with traffic interception on the network side.

What helps in the same situation on 3.9.x, and it fixed it there:

  • Open Settings (JSON) via Command Palette Ctrl+Shift+P then Preferences: Open User Settings (JSON) and add:

    "http.systemCertificates": true,
"http.experimental.systemCertificatesV2": true,
"cursor.general.disableHttp2": true

    Then fully restart Cursor. The V2 option pulls the corporate root CA from the OS certificate store, and disableHttp2 switches to HTTP/1.1 which tends to work better through SSL inspection.

  • Check that the corporate root CA is installed in Windows under Trusted Root Certification Authorities.

  • If that doesn’t help, ask IT to exclude Cursor domains from SSL inspection: api2.cursor.sh, api3.cursor.sh, api4.cursor.sh, repo42.cursor.sh, *.gcpp.cursor.sh. As another option, you can set the NODE_EXTRA_CA_CERTS environment variable to the path of the corporate .crt certificate and restart Cursor.

Related thread where this worked: Cursor stopped working after update — self-signed certificate / SSL decryption issue?

Let me know how it goes.

6

After changing the Open setting(JSON) i can actually run it but then when i try again it is not working anymore and sometimes it works.

when it is not working it will say Planning Next Moves > Reconnecting > Taking Longer Than Expected
(ive refreshed the Cursor IDE and also try running it in different file project)

then i checked the Cursor setting > Network Diagnostics > Running Diagnostics
for chat it is X and it said in red “Streaming response are being buffered by a proxy in your network environment”
for agents it is just loading (im using AUTO)

please help me

7

Hey, thanks for the update, that really clears things up.

That diagnostic message, Streaming responses are being buffered by a proxy in your network environment, is the key. It means a proxy or firewall in your corporate network is not letting real-time streaming through, and is buffering it instead. Cursor streams responses as they’re generated, and when the proxy buffers the stream, the connection gets stuck on Reconnecting > Taking Longer Than Expected. That’s why it sometimes works and sometimes doesn’t, it depends on which connections get intercepted.

The settings you already added help with the certificate handshake, but you can’t fully fix proxy-level buffering on the client side. Here’s what to do:

  1. Make sure all three are still in Settings (JSON):

    "http.systemCertificates": true,
"http.experimental.systemCertificatesV2": true,
"cursor.general.disableHttp2": true

    Then fully restart Cursor.

  2. Most important, ask your IT or network team to exclude Cursor domains from SSL inspection and buffering, no response buffering, allow streaming or SSE:

    • api2.cursor.sh
    • api3.cursor.sh
    • api4.cursor.sh
    • repo42.cursor.sh
    • *.gcpp.cursor.sh
      Without this, the proxy will keep breaking streaming.

  3. To confirm it’s the corporate network, connect to a different network for a couple minutes, like a mobile hotspot, and test chat. If it works reliably there, it’s definitely the proxy and IT will need to fix it.

Let me know how it goes, especially after testing on another network.

8

after using mobile data and my own private wifi at home it is still doesnt work for both :pensive_face:

CHAT
[2026-07-07T02:09:15.096Z] Response: ‘foo’ in 1ms
[2026-07-07T02:09:15.097Z] Response: ‘foo’ in 1ms
[2026-07-07T02:09:15.097Z] Response: ‘foo’ in 0ms
[2026-07-07T02:09:15.098Z] Response: ‘foo’ in 0ms
[2026-07-07T02:09:15.099Z] Result: Error: Streaming responses are being buffered by a proxy in your network environment

AGENT
[2026-07-07T02:09:08.989Z] Starting stream
[2026-07-07T02:09:08.990Z] Pushing first message

the rest is fine only these two are blocking it

9

Thanks for testing on other networks, that’s actually the key clue.

Looking at the logs from your last message, the chunks arrive in a burst within 0 to 1 ms, and then you immediately get a buffering error. That’s not network latency. It means something is holding the stream and only releasing it at the end instead of streaming it live. And the most important part is that it happens on both mobile data and home Wi‑Fi, so the interception is on the laptop itself, not in the corporate network.

On managed Windows 11 Enterprise there’s almost always an endpoint security agent installed like Zscaler Client Connector, Netskope, Cisco Umbrella, or an antivirus doing SSL inspection. It works at the OS level and intercepts traffic no matter which network you’re on. That’s why switching networks doesn’t help, the client travels with the laptop.

How to check and what to do:

  1. To confirm, run Cursor on a completely different personal computer, not a work one, on the same home Wi‑Fi. If chat and agent work fine there, then it’s definitely software on the work laptop. Also check the system tray and running processes for Zscaler, Netskope, Umbrella, or a corporate AV.

  2. The real fix needs your IT or network team. They need to exclude Cursor streaming domains from SSL inspection and response buffering, and allow streaming or SSE with no response buffering:

    • api2.cursor.sh
    • api3.cursor.sh
    • api4.cursor.sh
    • repo42.cursor.sh
    • *.gcpp.cursor.sh

  3. Keep the JSON settings you already added, they help with the certificate handshake:

    "http.systemCertificates": true,
"http.experimental.systemCertificatesV2": true,
"cursor.general.disableHttp2": true

You can’t fully fix endpoint buffering from the client side. You’ll need an exception from IT. Let me know how the test goes on the other computer, that should confirm the diagnosis.

10

May i know how can i answer the question below, this is the question the IT asking me

Please provide the risk exposure resulted from this exception and what are the additional controls implemented to reduce the risk exposure

11

Good question from your IT team. This is a standard format for justifying a security exception. Here’s some material you can share with them.

Risk exposure (what the exception is about):

The SSL inspection exception applies only to a narrow list of Cursor domains, not all traffic. Traffic to Cursor is already encrypted end-to-end (TLS 1.2+, AES-256 at rest), so SSL inspection on these domains doesn’t add extra protection. It mainly breaks streaming (SSE / HTTP/2 bidirectional), which is why Agent and Chat stop working. The scope is limited, and all other traffic will still go through inspection as usual.

The official recommendation and the current domain list to exclude are here: Network Configuration | Cursor Docs under SSL inspection and DLP and IP allowlisting. It’s best to pull the list directly from that page so IT always has the latest version.

Additional controls (what reduces the risk exposure):

  • The exception is scoped only to the Cursor domains from the docs above, and all other traffic stays under inspection.
  • If your policy requires inspection for all traffic, the proxy needs to support HTTP/2 bidirectional streaming (or a correct HTTP/1.1 fallback), SSE passthrough without buffering, long-running connections without forced timeouts, and disabled response buffering for streaming content. In that case, you may not need to exclude the domains, but the proxy must be configured properly.
  • Cursor is SOC 2 Type II, and a pentest report, DPA, and MSA are available. IT can request them via the Trust Center: https://trust.cursor.com and access is usually granted within one business day. These are the docs security teams usually attach to an exception request.

Also, teams can use Privacy Mode / Zero Data Retention, audit logs, and security controls via hooks. If you’re on a Team or Enterprise plan, you can list those as compensating controls.

Let me know if your IT team needs something specific from the Trust Center and I’ll point you to the right place.