How to fix npm ERR! code CERT_SIGNATURE_FAILURE npm ERR! Certificate signature failure in npm

npmINTERMEDIATEHIGHUpdated Dec 5, 2025· 138 views

The CERT_SIGNATURE_FAILURE error occurs when npm cannot verify the SSL certificate of the npm registry due to missing or invalid certificates in your trust store. This typically happens with firewalls, proxies, antivirus software, or outdated Node.js versions.

Quick fix

Fixes npm ERR! code CERT_SIGNATURE_FAILURE npm ERR! Certificate signature failure

node --version
npm --version

# On macOS with Homebrew:
brew upgrade node

# On Windows with Chocolatey:
choco upgrade nodejs

# On Linux, use nvm:
nvm install node

node --version
npm --version
  1. Upgrade Node.js and npm to the latest version
  2. Configure npm to use your system's default CA certificates
  3. Add your corporate certificate to npm configuration
  4. Disable antivirus/security software SSL inspection temporarily
npm — error
node --version
npm --version
# On macOS with Homebrew:
brew upgrade node
# On Windows with Chocolatey:
choco upgrade nodejs
# On Linux, use nvm:
nvm install node
node --version
npm --version
npm ERR! code CERT_SIGNATURE_FAILURE
npm ERR! Certificate signature failure

What this error means

When npm installs packages, it verifies the SSL certificate of the npm registry using your system's certificate store. The CERT_SIGNATURE_FAILURE error means that npm encountered a certificate whose signature cannot be verified—either because the certificate chain is incomplete, the signing authority is not trusted, or the certificate itself is invalid. This is a security check to prevent man-in-the-middle attacks. The error commonly occurs in corporate environments where firewalls or antivirus software intercept SSL connections, organizations using self-signed certificates, or when using private npm registries.

Typical symptoms

  • npm install fails immediately with 'CERT_SIGNATURE_FAILURE' error
  • npm ci command cannot fetch packages from the registry
  • Error occurs only when using specific networks or behind corporate firewalls
  • Works on personal network but fails on corporate/VPN network
  • All npm commands requiring network access fail with certificate errors

Common causes

  1. Antivirus or security software intercepting SSL connections (ESET, Kaspersky, Carbon Black, etc.)
  2. Corporate firewall or proxy inserting self-signed certificates into the SSL chain
  3. Outdated or incompatible Node.js or npm version with missing certificate support
  4. npm configuration using incompatible CA certificates that don't match the registry's certificate
  5. System certificate store missing or not properly configured for Node.js

How to fix "npm ERR! code CERT_SIGNATURE_FAILURE npm ERR! Certificate signature failure"

1Upgrade Node.js and npm to the latest version

The most reliable fix is upgrading to the latest stable version of Node.js, which includes an updated npm client with improved certificate handling.

bash
node --version
npm --version

# On macOS with Homebrew:
brew upgrade node

# On Windows with Chocolatey:
choco upgrade nodejs

# On Linux, use nvm:
nvm install node

node --version
npm --version
2Configure npm to use your system's default CA certificates

If upgrading didn't work, tell npm to use Node.js's CA store instead of npm's built-in certificates.

bash
npm config set ca=""

npm install

If it works, you're done. If not, proceed to the next step.

3Add your corporate certificate to npm configuration

If you're behind a corporate firewall, you need to add your organization's CA certificate to npm.

bash
# Set the certificate file path
npm config set cafile /path/to/your/certificate.crt

# Alternatively, use the NODE_EXTRA_CA_CERTS environment variable:
export NODE_EXTRA_CA_CERTS=/path/to/your/certificate.crt

# On Windows (PowerShell):
$env:NODE_EXTRA_CA_CERTS="C:\path\to\certificate.crt"

npm install
4Disable antivirus/security software SSL inspection temporarily

Many corporate security tools intercept SSL connections, causing certificate verification failures. Temporarily disable SSL inspection to test if that's the cause.

Common offenders:
- ESET antivirus (disable SSL/TLS Inspector in settings)
- Kaspersky antivirus (disable Web Anti-Virus SSL scanning)
- Carbon Black Cloud Sensor
- Zscaler or similar proxy software

Temporarily disable these tools, run npm install, then re-enable them. If npm works without them, work with your IT team to add npm.js.org to the SSL inspection whitelist.

5As a last resort: temporarily disable strict SSL verification

Only use this as a temporary workaround while you resolve the underlying certificate issue. This reduces security.

bash
npm install --strict-ssl=false

# Or set it globally (NOT RECOMMENDED for production)
npm config set strict-ssl false
npm install
npm config set strict-ssl true

# Alternative: use environment variable
NODE_TLS_REJECT_UNAUTHORIZED=0 npm install

Warning: After using these commands, you lose protection against man-in-the-middle attacks. This should only be temporary.

Advanced notes

The CERT_SIGNATURE_FAILURE error is fundamentally a certificate trust issue. The proper long-term solution is to identify what's intercepting the certificate chain (usually corporate security software) and work with your IT team to whitelist npm.js.org, registry.npmjs.org, and related CDNs in your firewall/proxy/antivirus software. For private npm registries, ensure the certificate is valid and signed by a trusted CA, or add the root CA certificate to your system's trust store and configure npm to use it via NODE_EXTRA_CA_CERTS.

Frequently asked questions

What does "npm ERR! code CERT_SIGNATURE_FAILURE npm ERR! Certificate signature fa" mean?
When npm installs packages, it verifies the SSL certificate of the npm registry using your system's certificate store. The CERT_SIGNATURE_FAILURE error means that npm encountered a certificate whose signature cannot be verified—either because the certificate chain is incomplete, the signing authority is not trusted, or the certificate itself is invalid. This is a security check to prevent man-in-the-middle attacks.
How do I fix "npm ERR! code CERT_SIGNATURE_FAILURE npm ERR! Certificate signature fa"?
The CERT_SIGNATURE_FAILURE error occurs when npm cannot verify the SSL certificate of the npm registry due to missing or invalid certificates in your trust store. This typically happens with firewalls, proxies, antivirus software, or outdated Node.js versions.
What causes "npm ERR! code CERT_SIGNATURE_FAILURE npm ERR! Certificate signature fa"?
Antivirus or security software intercepting SSL connections (ESET, Kaspersky, Carbon Black, etc.) Corporate firewall or proxy inserting self-signed certificates into the SSL chain Outdated or incompatible Node.js or npm version with missing certificate support
Is the "npm ERR! code CERT_SIGNATURE_FAILURE npm ERR! Certificate signature fa" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading