Google antigravity issue

Google Antigravity
1

Subject: Antigravity Windows TLS certificate validation failure – OAuth token exchange and agent execution

I am experiencing a persistent TLS certificate verification failure in Google Antigravity IDE on Windows 11. The same issue occurs in Antigravity’s standalone installer and VS Code integration.

OAuth error: Post https://oauth2.googleapis.com/token: tls: failed to verify certificate: x509: certificate signed by unknown authority.

Agent error: Get https://daily-cloudcode-pa.googleapis.com/v1internal/buildWithGooglePlugins?page_size=1000: tls: failed to verify certificate: x509: certificate signed by unknown authority.

Windows curl.exe using Schannel successfully establishes TLS to oauth2.googleapis.com and receives HTTP 404, as expected for a GET request without an OAuth payload. Windows proxy settings show direct access, and no proxy environment variables are configured.

The browser certificate viewer showed upload.video.google.com while accessing oauth2.googleapis.com. Please investigate the certificate hostname mismatch and whether Antigravity’s bundled Go/Electron networking stack is using a different root CA store or rejecting the certificate chain.

The issue persists after Windows updates, reinstalling Antigravity, clearing application caches, trying different versions, and resetting network settings. Please escalate this to the Antigravity authentication/networking engineering team. Please advise which diagnostic logs and certificate-chain details are required.

2

Hi @Anamika_sharma,

Welcome to the Forum.

Thank you for the detailed diagnostic notes. Here is what is happening with the upload.video.google.com certificate and the x509: certificate signed by unknown authority error on Windows 11, along with how to resolve it:

  1. Why the Browser Shows upload.video.google.com for oauth2.googleapis.com:

    • This is expected and is not a hostname mismatch. Google’s multi-domain certificate uses CN=upload.video.google.com as its legacy Common Name while listing *.googleapis.com in the Subject Alternative Name (SAN) extension.
    • Go’s crypto/x509 validates hostnames strictly against the SAN list (a hostname mismatch in Go would report x509: certificate is valid for ..., not ...). Instead, x509: certificate signed by unknown authority means the bundled Go language server (language_server_windows_x64.exe—shared across Antigravity IDE, Antigravity 2.0, and the VS Code extension) cannot verify the root or intermediate CA in the certificate chain.

  2. How to Resolve the x509: certificate signed by unknown authority Error on Windows 11:

    • Sync the Windows Root & Intermediate Certificate Store: On Windows, Go’s crypto/x509 verifies certificates via the Windows System Certificate Store, and will fail if the root (GTS Root R1) or intermediate (WR2) certificate is missing locally. Open an Administrator Command Prompt and run:

      cmd :

      certutil -generateSSTFromWU roots.sst

      certutil -addstore -f root roots.sst

      (You can also open https://oauth2.googleapis.com in your browser, export the GTS Root R1 and WR2 certificates from the certificate viewer, and import them into Windows certmgr.msc under Trusted Root Certification Authorities and Intermediate Certification Authorities.)

    • Check for Transparent TLS Inspection or DNS Interception: Even when Windows proxy settings show direct access, an ISP filter, router firewall, or antivirus HTTPS/SSL scanner can intercept traffic or alter the TLS chain. Ensure your network’s custom CA certificate (if any) is installed in your Windows Trusted Root Certification Authorities store, bypass SSL inspection for *.googleapis.com and oauth2.googleapis.com, or test with Windows DNS set to 8.8.8.8 / 1.1.1.1.

  3. Diagnostic Details (If the Issue Persists): If the steps above do not resolve the issue, please reply with:

    • Your exact Antigravity version and Windows 11 build (winver).
    • The terminal output of curl.exe -vI https://oauth2.googleapis.com/token (specifically the schannel: subject and issuer: lines).
    • The log output from View → Output → Antigravity (or %APPDATA%\Antigravity\logs\main.log).