npm error code UNABLE_TO_GET_ISSUER_CERT_LOCALLY

npm 10 and later prefix lines with "npm error"; npm 9 and older used "npm ERR!". The following lines repeat the code as errno and give the URL with "reason: unable to get local issuer certificate".

npm (Node.js) — registry request over HTTPS

What it means

npm could not verify the registry's TLS certificate: the chain it received leads to a root that is not among the CAs Node.js trusts. npm runs on Node.js, which by default trusts only its built-in Mozilla root list, so a company or proxy root installed in the operating system is not used. The request fails before any package is downloaded.

Why it happens

• A TLS-inspecting proxy re-signs registry.npmjs.org

  common

  On company networks the proxy presents certificates issued by its own CA. Browsers trust it through the OS; npm, through Node.js, does not.

• A private registry with a company certificate

  common

  Artifactory, Nexus, Verdaccio or GitHub Enterprise package registries often use a certificate from an internal CA that is not in Node.js's root list.

• The root is in the OS store, but Node.js uses its own list

  occasional

  update-ca-certificates, the macOS Keychain and the Windows store do not affect Node.js unless it is told to use the system store.

How to fix it

1. 1.

   Set npm's cafile

   npm config set cafile points npm at a PEM file with the CA certificates to trust for registry requests (stored in your user .npmrc; --location=project or --location=global for other scopes). npm then trusts only the CAs in that file, so include the public roots as well if npm also reaches registries that are not behind your CA.

   # npm's own setting: a PEM file with the CA(s) to trust for registry requests
   npm config set cafile /etc/ssl/private-ca/corp-root-ca.pem
   npm config get cafile

2. 2.

   Use NODE_EXTRA_CA_CERTS

   The certificates in this file are added to Node.js's built-in roots for every Node.js process started with the variable, including npm, npx and build tools.

   # Adds to Node.js's built-in roots for npm and every other Node.js tool in this shell
   export NODE_EXTRA_CA_CERTS=/etc/ssl/private-ca/corp-root-ca.pem
   npm install

3. 3.

   Use the operating system's trust store

   With NODE_USE_SYSTEM_CA=1 (Node.js versions that support --use-system-ca), npm trusts the roots IT has deployed in the OS.

   # Trust what the OS trusts (corporate roots deployed by IT)
   NODE_USE_SYSTEM_CA=1 npm install

4. 4.

   CI: provide the CA through the environment

   Commit the company root (it is public) or fetch it in the job, and set NODE_EXTRA_CA_CERTS for the steps that run npm.

   # CI job (GitHub Actions syntax): provide the CA to npm without touching the image
   env:
     NODE_EXTRA_CA_CERTS: ${{ github.workspace }}/certs/corp-root-ca.pem
   steps:
     - run: npm ci

5. 5.

   Temporary diagnostic: --strict-ssl=false for one command

   Disables certificate verification for registry requests. It confirms the diagnosis but lets anyone on the path substitute packages, which then run install scripts on your machine; never keep it in .npmrc.

   # Temporary diagnostic for one command only, never in .npmrc
   npm install --strict-ssl=false

← Browse the full signature error database