Error: ERR_PNPM_RESOLVING_NPM_RESOLVER_NETWORK_ERROR

The headline code depends on the command: ERR_PNPM_RESOLVING_NPM_RESOLVER_NETWORK_ERROR for pnpm install, ERR_PNPM_PACKAGE_MANAGER_ADD_RESOLVE_LATEST for pnpm add. The cause chain below it reads "Failed to fetch metadata from <url>: error sending request: client error (Connect): invalid peer certificate: UnknownIssuer" and wraps at 80 columns. pnpm 10 and older run on Node.js and report Node.js codes such as SELF_SIGNED_CERT_IN_CHAIN or UNABLE_TO_GET_ISSUER_CERT_LOCALLY instead.

pnpm 12 (native binary, rustls) — registry request over HTTPS fails with "invalid peer certificate: UnknownIssuer"

What it means

pnpm 12 could not fetch package metadata from the registry, and the chain of causes it prints ends in "invalid peer certificate: UnknownIssuer": a TLS verification failure. pnpm 12 is a native binary whose HTTP client verifies certificates with rustls, and "UnknownIssuer" is rustls's single code for every chain-building failure: unknown private CA, proxy root, missing intermediate or self-signed certificate.

Why it happens

• Check the last line first: the code also covers plain network errors

  common

  ERR_PNPM_RESOLVING_NPM_RESOLVER_NETWORK_ERROR is used for DNS, connection and proxy failures too. Only when the cause chain ends in "invalid peer certificate" is it a certificate problem.

• A private registry with a company certificate

  common

  Internal registries signed by a company CA that is not in pnpm's trusted set.

• A TLS-inspecting proxy

  common

  On company networks, registry.npmjs.org is re-signed by the proxy's root.

• A self-signed or leaf-only registry certificate

  occasional

  rustls does not distinguish these cases: a self-signed certificate and a missing intermediate also end up as UnknownIssuer.

How to fix it

1. 1.

   Set cafile in .npmrc

   pnpm reads npm-style configuration files; cafile (or an inline ca value) adds the CA for registry requests.

   ; .npmrc (project or ~/.npmrc) — read by pnpm as well as npm
   cafile=/etc/ssl/private-ca/corp-root-ca.pem

2. 2.

   Install the root in the operating system store

   In our test pnpm 12 accepted a root added with update-ca-certificates, so roots deployed by IT work without further configuration.

   # pnpm 12 also trusts the operating system's store
   sudo cp corp-root-ca.pem /usr/local/share/ca-certificates/corp-root-ca.crt
   sudo update-ca-certificates

3. 3.

   Or use NODE_EXTRA_CA_CERTS

   pnpm 12 honours the variable as well, which keeps one setting for Node.js, npm and pnpm.

   # Honoured by pnpm 12 too, so one variable covers node, npm and pnpm
   export NODE_EXTRA_CA_CERTS=/etc/ssl/private-ca/corp-root-ca.pem
   pnpm install

← Browse the full signature error database