UnknownIssuer error raised when the client side is behind a TLS inspection firewall (ZScaler)

[QueShengyao]

When running longbridge auth login on Windows behind a Zscaler TLS inspection proxy, the CLI fails during OAuth dynamic client registration with an UnknownIssuer certificate error.

longbridge auth login
Authentication failed: Client registration request failed: error sending request for url (https://openapi.longbridge.com/oauth2/register): client error (Connect): invalid peer certificate: UnknownIssuer

Environment

OS: Windows
Longbridge CLI: 0.24.0
Install path: C:\Users\xxxx\AppData\Local\Programs\longbridge\longbridge.exe
Network: corporate network using Zscaler TLS inspection

What Works

The Zscaler root CA is trusted by Windows and works with other clients. For example, PowerShell can connect to the same endpoint successfully and receives the expected API error response from Longbridge rather than a TLS failure:

Invoke-WebRequest `
  -Uri "https://openapi.longbridge.com/oauth2/register" `
  -Method Post `
  -Body "{}" `
  -ContentType "application/json"

Result:

{
  "error": "invalid_request",
  "error_description": "client_name is required"
}

What I Tried

I tried setting common CA bundle environment variables before running the CLI:

$env:SSL_CERT_FILE="C:\temp\lb\zscaler-root.pem"
$env:REQUESTS_CA_BUNDLE="C:\temp\lb\zscaler-root.pem"
$env:CURL_CA_BUNDLE="C:\temp\lb\zscaler-root.pem"
$env:SSL_CERT_DIR="C:\temp\lb"

longbridge auth login -v

But the CLI still fails with:

POST https://openapi.longbridge.com/oauth2/register  (dynamic client registration)
Authentication failed: Client registration request failed: error sending request for url (https://openapi.longbridge.com/oauth2/register): client error (Connect): invalid peer certificate: UnknownIssuer

longbridge update also fails on the same kind of request:

Error: error sending request for url (https://open.longbridge.com/github/release/longbridge-terminal/latest)

Expected Behavior

The CLI should either:

1. Use the native Windows certificate store on Windows.
2. Provide a documented option or environment variable for a custom CA bundle.
3. Clearly document how users behind corporate TLS inspection should configure trusted roots.

Actual Behavior

The CLI appears unable to trust a corporate root CA that is trusted by Windows and usable by other tools. The error blocks OAuth login and the self-update command.