npm error code SELF_SIGNED_CERT_IN_CHAIN

npm 10 and later print "npm error code SELF_SIGNED_CERT_IN_CHAIN"; npm 9 and older "npm ERR! code SELF_SIGNED_CERT_IN_CHAIN". The next lines repeat the code as errno and name the URL with "reason: self-signed certificate in certificate chain".

npm (Node.js) — registry request over HTTPS

What it means

The registry connection presented a certificate chain that ends in a self-signed root unknown to Node.js. For registry.npmjs.org this means the traffic is being intercepted and re-signed, almost always by a company proxy or an antivirus product with HTTPS scanning, whose root the browser trusts but npm does not.

Why it happens

• A corporate TLS-inspecting proxy

  common

  Zscaler, Netskope, Palo Alto, Fortinet and similar products sit between your machine and the registry and present their own root in the chain.

• Antivirus or endpoint protection with HTTPS scanning

  occasional

  Some endpoint products intercept TLS locally on the machine and inject their root into the OS store only.

• A private registry that sends its own root

  occasional

  Internal registries signed by a company CA that serve the root in their chain still need that root trusted by Node.js.

How to fix it

1. 1.

   Give npm the proxy's root with cafile

   Export the root certificate (from your IT team or the OS trust store) as PEM and set it as npm's cafile. npm then trusts only the CAs in that file, so on laptops that also work off the company network, add the public roots to the same file or prefer NODE_EXTRA_CA_CERTS.

   npm config set cafile /etc/ssl/private-ca/corp-proxy-root.pem
   npm install

2. 2.

   Or set NODE_EXTRA_CA_CERTS

   Adds the root for npm and every other Node.js tool without replacing Node.js's public roots. On Windows, set it as a user environment variable and open a new terminal.

   # Windows (PowerShell): setx NODE_EXTRA_CA_CERTS C:\certs\corp-proxy-root.pem
   export NODE_EXTRA_CA_CERTS=/etc/ssl/private-ca/corp-proxy-root.pem
   npm install

3. 3.

   Or let Node.js use the OS store

   NODE_USE_SYSTEM_CA=1 makes Node.js (and npm) trust what the operating system trusts, which on managed machines includes the proxy root.

   # Managed machines already trust the proxy root in the OS store
   NODE_USE_SYSTEM_CA=1 npm install

4. 4.

   Temporary diagnostic: --strict-ssl=false

   Only to confirm that trust is the issue. Packages run install scripts, so accepting unverified downloads is how supply-chain attacks get onto developer machines; never put strict-ssl=false in .npmrc.

   # Temporary diagnostic for one command only
   npm install --strict-ssl=false

← Browse the full signature error database