error Error: self-signed certificate in certificate chain

Yarn 1.x prints "error Error: …" followed by a Node.js stack trace (at TLSSocket.onConnectSecure …). Node.js 16 and older spell it "self signed". Yarn 4 reports TLS failures in its own format, "➤ YN0001: RequestError: <reason>".

Yarn Classic (1.x) — registry request over HTTPS

What it means

Yarn Classic could not verify the registry's certificate because the chain ends in a self-signed root that Node.js does not trust. Yarn prints the Node.js error as is, with a stack trace below it. On a company network this is the classic symptom of a TLS-inspecting proxy whose root is trusted by the browser but not by Node.js.

Why it happens

• A TLS-inspecting proxy re-signs registry.yarnpkg.com

  common

  Company proxies present certificates from their own root, which the OS trusts but Node.js does not.

• A private registry that sends its own root

  occasional

  Internal registries with company certificates; the root in the chain still has to be trusted on the client.

• Node.js ignores the OS trust store

  occasional

  Yarn runs on Node.js, which uses its built-in root list unless told otherwise.

How to fix it

1. 1.

   Set Yarn 1's cafile

   yarn config set cafile makes Yarn verify the registry against that PEM file; like npm's setting, it replaces the default roots for registry requests.

   # Yarn 1.x setting (stored in ~/.yarnrc)
   yarn config set cafile /etc/ssl/private-ca/corp-proxy-root.pem
   yarn config get cafile

2. 2.

   Or use NODE_EXTRA_CA_CERTS

   Adds the root to Node.js's built-in list for Yarn and every other Node.js tool in the environment.

   export NODE_EXTRA_CA_CERTS=/etc/ssl/private-ca/corp-proxy-root.pem
   yarn install

3. 3.

   Yarn 4: httpsCaFilePath

   Modern Yarn reads httpsCaFilePath from .yarnrc.yml; Yarn 4 refuses to start when it finds the legacy caFilePath key.

   # Yarn 4 (Berry): .yarnrc.yml — Yarn 4 rejects the old caFilePath key
   httpsCaFilePath: /etc/ssl/private-ca/corp-proxy-root.pem

4. 4.

   Temporary diagnostic: strict-ssl false

   Confirms trust is the only problem. Packages run install scripts, so leaving verification off invites substituted packages; delete the setting right after the test.

   # Temporary diagnostic only; revert immediately afterwards
   yarn config set strict-ssl false && yarn install; yarn config delete strict-ssl

← Browse the full signature error database