npm error code ERR_TLS_CERT_ALTNAME_INVALID

npm 10 and later print "npm error code ERR_TLS_CERT_ALTNAME_INVALID", npm 9 and older "npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID". The host and altnames in the reason line come from your configuration and the server's certificate.

npm (Node.js) — registry request over HTTPS

What it means

The registry's certificate is trusted, but it was not issued for the host name in the registry URL npm used. The reason line spells out both sides: the host npm asked for and the names the certificate carries. Typical after a registry moves to a new name, or when the registry URL uses an alias, an IP address or the wrong environment.

Why it happens

• The registry URL uses a name the certificate does not cover

  common

  An alias, an IP address, an old host name kept in .npmrc or in package-lock.json resolved URLs, or a staging host reused in production.

• A proxy answers with a certificate for another name

  occasional

  Misconfigured forward proxies and captive portals present their own certificate, which does not name the registry.

• The registry's certificate lacks a name

  occasional

  A certificate reissued without one of the names clients use, for example the old host name kept as an alias.

How to fix it

1. 1.

   Compare npm's registry setting with the certificate

   Print the configured registry (and proxy settings) and the certificate's SAN list. Lockfiles also contain resolved URLs; they must use the same host.

   npm config get registry
   npm config list | grep -iE 'registry|proxy'
   echo | openssl s_client -connect registry.example.com:443 -servername registry.example.com 2>/dev/null \
     | openssl x509 -noout -ext subjectAltName

2. 2.

   Point npm at the certificate's name

   Update the registry setting in every .npmrc level (and regenerate lockfiles if they contain the old host).

   # Use the host name the registry's certificate was issued for
   npm config set registry https://npm.example.com/

3. 3.

   Registry owners: cover every name in use

   Reissue the registry's certificate with all host names clients use, including aliases kept for compatibility.

   # Registry owners: include every name clients use
   sudo certbot certonly --nginx -d npm.example.com -d registry.example.com

← Browse the full signature error database