Warning: Ignoring extra certs from `/etc/ssl/private-ca/corp-root-ca.pem`, load failed: error:80000002:system library::No such file or directory

The path is your variable's value; the reason varies: "No such file or directory" for a missing file, "Permission denied" for an unreadable one, and an OpenSSL PEM error when the file exists but is not in PEM format.

Node.js start-up — NODE_EXTRA_CA_CERTS could not be read

What it means

Node.js read NODE_EXTRA_CA_CERTS at start-up but could not load the file it names, so it starts without your extra CA certificates. The process does not stop; the connections that needed those certificates fail later with "unable to get local issuer certificate" or "self-signed certificate in certificate chain". The OpenSSL reason after "load failed:" tells you why.

Why it happens

• The path exists on the host but not where Node.js runs

  common

  The variable was copied into a Dockerfile, CI configuration or devcontainer while the certificate file stayed on the developer's machine; inside the container or runner the path does not exist.

• A relative path or an unexpanded ~

  common

  Values like ./certs/ca.pem resolve from the current working directory of the process, and "~/certs/ca.pem" in a .env file or systemd unit is not expanded by any shell.

• Unreadable file or wrong format

  occasional

  A certificate exported from Windows as DER (.cer), a file readable only by root, or a file containing something other than PEM certificates.

How to fix it

1. 1.

   Check the file the variable points to

   Confirm that the path exists for the user running Node.js and that openssl can read it as a PEM certificate.

   echo "$NODE_EXTRA_CA_CERTS"
   ls -l "$NODE_EXTRA_CA_CERTS"
   openssl x509 -in "$NODE_EXTRA_CA_CERTS" -noout -subject   # must be PEM: -----BEGIN CERTIFICATE-----

2. 2.

   Containers: ship the file with the variable

   Copy the CA certificate into the image (or mount it) at the same path the variable names.

   # Dockerfile: put the file where the variable points, inside the image
   COPY corp-root-ca.pem /usr/local/share/ca-certificates/corp-root-ca.crt
   ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root-ca.crt

3. 3.

   Use an absolute path

   Expand the path when you set the variable, so it does not depend on the working directory or on shell expansion.

   # Absolute path, expanded by the shell before node starts
   export NODE_EXTRA_CA_CERTS="$HOME/certs/corp-root-ca.pem"

4. 4.

   Convert DER to PEM

   NODE_EXTRA_CA_CERTS expects PEM. Convert binary exports with openssl x509 -inform der; several certificates can be concatenated in one PEM file.

   # A DER (.cer) export from Windows must be converted to PEM first
   openssl x509 -inform der -in corp-root-ca.cer -out corp-root-ca.pem

← Browse the full signature error database