How to fix Error: SSL: CERTIFICATE_VERIFY_FAILED (SSL protocol error) in Node.js

Node.jsINTERMEDIATEHIGH

SSL protocol errors occur when Node.js cannot verify an HTTPS server's certificate. This happens due to missing intermediate certificates, self-signed certificates, expired certificates, or incorrect system time. Learn how to diagnose and fix certificate verification failures safely.

What this error means

This error occurs when your Node.js application attempts to make an HTTPS request (or establish a TLS connection) but cannot verify the server's SSL/TLS certificate. Node.js validates certificates by checking the complete certificate chain: the server certificate, any intermediate certificates, and the root certificate. If any part of this chain is missing, improperly configured, or issued by an untrusted Certificate Authority, Node.js rejects the connection. The error does not mean the certificate is necessarily invalid—it means your system cannot establish trust in the certificate through the standard verification process. This is a security feature that prevents man-in-the-middle (MITM) attacks and other certificate-based threats.

How to fix "Error: SSL: CERTIFICATE_VERIFY_FAILED (SSL protocol error)"

1Verify the system time is correct

SSL certificates have validity periods (not-before and not-after dates). If your system clock is significantly wrong, valid certificates may appear expired or not-yet-valid.

Check current time:

bash

date

If the time is incorrect, sync your system clock using NTP (Network Time Protocol):

Linux/macOS:

bash

sudo ntpdate -s time.nist.gov
# or
sudo timedatectl set-ntp true

Windows:

bash

w32tm /resync

Restart your Node.js application after correcting the time.

2Check if the certificate is expired

Verify the expiration date of the server's certificate using OpenSSL:

bash

openssl s_client -connect example.com:443 -showcerts 2>/dev/null | grep -A 5 "notAfter"

Or for a specific port:

bash

echo | openssl s_client -connect api.example.com:8443 2>/dev/null | openssl x509 -noout -dates

If the certificate has expired, the server administrator must renew it. If it's a self-signed certificate you control, generate a new one with an extended validity period:

bash

openssl req -x509 -newkey rsa:4096 -nodes -out cert.pem -keyout key.pem -days 365

3Download the server's certificate chain

Get the full certificate chain from the server:

bash

openssl s_client -connect example.com:443 -showcerts 2>/dev/null > fullchain.pem

This will output all certificates in the chain. Save this file for the next steps.

Alternatively, download just the certificate using a web browser (click the padlock icon) or use:

bash

openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -outform PEM > server-cert.pem

4Use NODE_EXTRA_CA_CERTS to include additional CA certificates

For self-signed or internal CA certificates, tell Node.js to trust them by setting the NODE_EXTRA_CA_CERTS environment variable:

Linux/macOS:

bash

export NODE_EXTRA_CA_CERTS=/path/to/ca-cert.pem
node your-app.js

Windows (PowerShell):

powershell

$env:NODE_EXTRA_CA_CERTS = "C:\path\to\ca-cert.pem"
node your-app.js

Windows (Command Prompt):

cmd

set NODE_EXTRA_CA_CERTS=C:\path\to\ca-cert.pem
node your-app.js

If you have multiple CA certificates, concatenate them into a single file:

bash

cat ca1.pem ca2.pem ca3.pem > ca-bundle.pem
export NODE_EXTRA_CA_CERTS=/path/to/ca-bundle.pem
node your-app.js

This is the recommended approach for corporate or development environments with internal CAs.

5Configure certificate in your Node.js code (optional)

For more control, you can also configure certificates directly in your Node.js code:

javascript

import https from 'https';
import fs from 'fs';

const ca = fs.readFileSync('/path/to/ca-cert.pem', 'utf8');

const options = {
  hostname: 'api.example.com',
  port: 443,
  path: '/endpoint',
  method: 'GET',
  ca: ca,  // Add the CA certificate
};

const req = https.request(options, (res) => {
  res.on('data', (chunk) => {
    console.log('Received:', chunk.toString());
  });
});

req.on('error', (err) => {
  console.error('Request failed:', err.message);
});

req.end();

For fetch (Node.js 18+):

javascript

import https from 'https';
import fs from 'fs';

const ca = fs.readFileSync('/path/to/ca-cert.pem', 'utf8');
const agent = new https.Agent({ ca });

const response = await fetch('https://api.example.com/endpoint', {
  agent,
});

For axios:

javascript

import https from 'https';
import fs from 'fs';
import axios from 'axios';

const ca = fs.readFileSync('/path/to/ca-cert.pem', 'utf8');
const httpsAgent = new https.Agent({ ca });

axios.get('https://api.example.com/endpoint', {
  httpsAgent,
});

6Update Node.js and dependencies

Outdated Node.js versions may have incomplete or outdated CA certificate bundles. Update to the latest stable release:

bash

# Check current version
node --version

# Update Node.js (use nvm, brew, or download from nodejs.org)
nvm install node  # if using nvm
# or
brew upgrade node  # if using Homebrew

# Update npm packages
npm update
npm audit fix

After updating, restart your application.

7Add self-signed certificate to system trust store (permanent solution)

For development environments, you can permanently add a self-signed certificate to your system's trusted CA store:

Linux (Debian/Ubuntu):

bash

sudo cp ca-cert.pem /usr/local/share/ca-certificates/ca-cert.crt
sudo update-ca-certificates

macOS:

bash

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca-cert.pem

Windows:
Right-click the .pem or .crt file → Install Certificate → Select "Local Machine" → Place in "Trusted Root Certification Authorities"

After adding, restart Node.js to apply the changes.

How to fix Error: SSL: CERTIFICATE_VERIFY_FAILED (SSL protocol error) in Node.js

What this error means

Typical symptoms

Common causes

How to fix "Error: SSL: CERTIFICATE_VERIFY_FAILED (SSL protocol error)"

Advanced notes

Related errors

Official resources & further reading