Antigravity 2.5.5 fails with x509 cert error, works fine on 2.1.1 (Windows 11 25H2)

Google Antigravity
1

Environment:

  • Antigravity IDE version: 2.5.5 (also reproduced on 2.5.3)
  • Works fine on: version 2.1.1
  • OS: Windows 11, version 25H2 (Build 10.0.26200.8875)
  • Error ID (latest): 691b3f5f5d194987a313cc260cd9249d

Error message:

Error: Get “https://daily-cloudcode-pa.googleapis.com/v1internal/buildWithGooglePlugins?page_size=1000”: tls: failed to verify certificate: x509: certificate signed by unknown authority (error ID: 06c24475d93345059e1758a0a951d8f1)

Chat/Agent panel also shows: Error Unknown: Agent execution terminated due to error.

Steps to reproduce:

  1. Install Antigravity IDE 2.5.5 (fresh install) on Windows 11 25H2
  2. Sign in with Google account
  3. Open the chat/agent panel
  4. Send any message → immediately fails with the TLS/x509 error above

What I’ve already tried (all failed to fix it):

  • Logged out and back in
  • Renamed %APPDATA%\Antigravity to reset local config
  • Full clean install: uninstalled completely, manually deleted %APPDATA%\Antigravity and %LOCALAPPDATA%\Antigravity, reinstalled 2.5.5 fresh to a new location (D:)
  • Updated Windows Root Certificate store via certutil -generateSSTFromWU + certutil -addstore -f root (completed successfully)
  • Checked hosts file — no suspicious entries, default Microsoft sample file only
  • Checked all running processes and services — no proxy/VPN/MITM software found
  • Tried connecting through a VPN (different region) — same error persists
  • Confirmed no third-party antivirus with HTTPS/web scanning is installed

Evidence the issue is NOT with my system/network:

Opening ://daily-cloudcode-pa.googleapis.com directly in a browser (Brave) returns a normal 404 page from Google with a valid TLS padlock — no certificate warning.

I also ran curl -v against the exact same endpoint from Command Prompt, and it succeeds completely (TLS handshake via Windows Schannel works fine, gets a proper 401 response from Google’s API, which is expected without an auth token):

Microsoft Windows [Version 10.0.26200.8875]

C:\Users\Muhammad_Rifki>curl -v ://daily-cloudcode-pa.googleapis.com/v1internal/buildWithGooglePlugins?page_size=1000

  • Host .ht.tps.daily-cloudcode-pa.googleapis.com:443 was resolved.
  • Trying 172.217.119.4:443…
  • Established connection to .h.ttps.daily-cloudcode-pa.googleapis.com (172.217.119.4 port 443)
  • using HTTP/1.x
  • schannel: remote party requests renegotiation
  • schannel: renegotiating SSL/TLS connection
  • schannel: SSL/TLS connection renegotiated
    < HTTP/1.1 401 Unauthorized
    < WWW-Authenticate: Bearer realm=“.h.ttps://accounts.google.com/”
    …
    {
    “error”: {
    “code”: 401,
    “message”: “Request is missing required authentication credential…”,
    “status”: “UNAUTHENTICATED”
    }
    }
  • Connection #0 to host .daily-cloudcode-pa.googleapis.com:443 left intact

This confirms the TLS certificate chain for this endpoint is valid and trusted by Windows itself (via Schannel) and by my browser. The failure only happens inside the Antigravity 2.5.x client, which strongly suggests it’s not validating against the OS trust store, or has an outdated/incomplete bundled CA store, or is mishandling the TLS renegotiation shown above (possibly a Go-based client rejecting renegotiation by default).

Downgrading back to 2.1.1 resolves the issue completely with no other changes.

Happy to provide more logs or test anything — this is currently blocking me from using any version newer than 2.1.1.

2

I am having a very similar issue… I went on my mobile hotspot which is a non-EU SIM and could see my DNS resolution was matching what the IPs should be, and everything came right up. No clue where to even report this. I had the same issue with oauth2.

whatsmydns