npm error code CERT_HAS_EXPIRED

npm 10 and later print "npm error code CERT_HAS_EXPIRED"; npm 9 and older "npm ERR! code CERT_HAS_EXPIRED". The following lines give the URL with "reason: certificate has expired".

npm (Node.js) — registry request over HTTPS

What it means

A certificate in the chain npm received from the registry (or from a proxy in between) is past its expiry date by this machine's clock. For the public registry this almost never means npm's own certificate expired: it points to an old CA pinned in your npm configuration, an outdated Node.js root list, a proxy certificate, or a wrong clock. For private registries, the server's certificate may really have expired.

Why it happens

• The private registry's certificate expired

  common

  Self-hosted Nexus, Artifactory or Verdaccio instances and corporate proxies whose certificates are renewed by hand.

• A very old Node.js with outdated roots

  occasional

  Node.js ships its root list in the binary; releases from before a CA's root rollover may only know the expired root and fail where current releases succeed.

• An old CA pinned with the ca or cafile setting

  occasional

  A ca= or cafile= entry left in .npmrc years ago replaces Node.js's default roots for registry requests, so npm keeps validating against that old, now expired certificate.

• The system clock is wrong

  occasional

  Check the date on VMs, containers and devices without a battery-backed clock before changing configuration.

How to fix it

1. 1.

   Check which registry and certificate are involved

   Read the configured registry and the end date of the certificate it serves. An expired certificate on a private registry must be renewed on the server.

   npm config get registry
   echo | openssl s_client -connect registry.example.com:443 -servername registry.example.com 2>/dev/null \
     | openssl x509 -noout -subject -enddate

2. 2.

   Remove stale ca or cafile settings

   npm config list shows settings from every .npmrc level; delete ca or cafile entries that point to old certificates (or update the file they reference).

   # An old CA pinned in .npmrc replaces the default roots: list and remove it
   npm config list | grep -E '^;? *(ca|cafile)'
   npm config delete ca
   npm config delete cafile

3. 3.

   Upgrade Node.js and npm

   A maintained Node.js release brings a current root list; upgrade npm afterwards.

   node -v && npm -v   # Node.js bundles its root list; very old releases carry expired roots
   # upgrade Node.js to a maintained release (nvm, fnm, volta or your OS packages), then:
   npm install -g npm@latest

← Browse the full signature error database