This is a known issue when Cursor runs behind a corporate VPN or proxy that performs SSL inspection, which replaces certificate chains with your company’s own CA.
A few things to try, in this order:
-
Enable system certificates — In Cursor, go to Settings (gear icon) and search for
systemCertificates. Enable bothhttp.systemCertificatesandhttp.experimental.systemCertificatesV2. This tells Cursor to trust certificates from your macOS Keychain. -
Verify your corporate CA is trusted in macOS Keychain — Open Keychain Access, make sure your company’s root CA certificate is in the System keychain and marked as “Always Trust” for SSL.
-
Switch to HTTP/1.1 — On the same Network settings page where you ran diagnostics, change the HTTP Compatibility Mode dropdown to HTTP/1.1. HTTP/2 can be stricter with certificate validation through proxies.
-
Optional extension — The mac-ca-vscode extension injects macOS system certificates into Cursor’s Node.js layer, which has helped other users in similar corporate setups.
If none of these help, check with your IT team whether Cursor’s domains (*.cursor.sh, *.cursor-cdn.com, *.cursorapi.com) can be added to the VPN’s bypass list so traffic to Cursor doesn’t go through SSL inspection.
Related thread with more context: Cursor Tab not working: certificate signature failure