yarn switch: error sending request for url

[bgotink]

I'm trying to use yarn switch but I immediately encounter issues:

$ cd (mktemp -d)
$ source ~/.yarn/switch/env.fish 
$ yarn init -y
Error: error sending request for url (https://repo.yarnpkg.com/channels/default/stable)

› yarn init […ARGSN]

I should note that I'm running on a device with a TLS intercepting proxy installed on it, so repo.yarnpkg.com responds using a certificate signed by a private CA. This CA is installed on my system, so for e.g. yarn berry and corepack I'm used to passing NODE_OPTIONS=--use-system-ca for certain commands.

$ node
Welcome to Node.js v24.12.0.
Type ".help" for more information.
> await (await fetch("https://repo.yarnpkg.com/channels/default/stable")).text()
Uncaught TypeError: fetch failed
    at node:internal/deps/undici/undici:15845:13
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async REPL1:1:40 {
  [cause]: Error: unable to get local issuer certificate
      at TLSSocket.onConnectSecure (node:_tls_wrap:1631:34)
      at TLSSocket.emit (node:events:508:28)
      at TLSSocket.emit (node:domain:552:15)
      at TLSSocket._finishInit (node:_tls_wrap:1077:8)
      at ssl.onhandshakedone (node:_tls_wrap:863:12)
      at TLSWrap.callbackTrampoline (node:internal/async_hooks:130:17) {
    code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
  }
}

$ node --use-system-ca
Welcome to Node.js v24.12.0.
Type ".help" for more information.
> await (await fetch("https://repo.yarnpkg.com/channels/default/stable")).text()
'6.0.0-rc.13\n'

$ openssl s_client -connect repo.yarnpkg.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -text -noout | head -n10
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            Redacted
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=Redacted, O=Redacted., OU=Redacted., CN=Redacted Intermediate Root CA 
        Validity
            Not Before: Feb  9 05:38:18 2026 GMT
            Not After : Feb 21 05:13:57 2026 GMT

[bgotink]

The latest rekwest (0.13.0, announcement) has modified the settings, defaulting to rustls and importantly defaulting to using the platform-native certificate verifier.
It sounds like updating rekwest would solve this issue.