How to fix npm ERR! DEPTH_ZERO_SELF_SIGNED_CERT in npm

Inspect the certificate the registry presents:

openssl s_client -connect your-registry:443 </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -subject

If the issuer equals the subject, the certificate is self-signed (depth zero), which confirms this error.

Save the certificate so you can add it to a trust store:

openssl s_client -connect your-registry:443 </dev/null 2>/dev/null \
  | openssl x509 > self-signed.crt

If the registry is reachable in a browser, you can also export the certificate from the browser's certificate viewer as a PEM (.crt/.pem) file.

Point npm at a CA file containing the certificate. cafile is a global npm setting - npm does not support a per-registry cafile key, so configure it once:

npm config set cafile /path/to/self-signed.crt

cafile should contain the trust anchor: for a true self-signed leaf, that is the certificate itself; if the server is fronted by a private CA, use that CA's certificate. To combine your private CA with the public roots Node ships, set the environment variable instead so the default roots are kept:

export NODE_EXTRA_CA_CERTS=/path/to/self-signed.crt

This is the safest fix because TLS verification stays enabled - you are only adding a new trust anchor, not disabling checks.

Trusting the certificate at the OS level fixes npm and every other TLS client (git, curl, etc.) at once:

# Ubuntu/Debian
sudo cp self-signed.crt /usr/local/share/ca-certificates/your-registry.crt
sudo update-ca-certificates

# RHEL/Fedora
sudo cp self-signed.crt /etc/pki/ca-trust/source/anchors/your-registry.crt
sudo update-ca-trust

# macOS
sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain self-signed.crt

# Windows (run PowerShell/cmd as admin)
certutil -addstore -f "ROOT" self-signed.crt

On Linux, set NODE_EXTRA_CA_CERTS (see step 3) or npm config set cafile as well, because Node does not automatically read the system store.

mkcert installs a local CA into your system (and browser) trust stores, so certificates it issues are trusted automatically - avoiding self-signed errors entirely:

# Install mkcert (examples)
brew install mkcert       # macOS
# choco install mkcert    # Windows
# apt install mkcert      # Debian/Ubuntu (or download the release binary)

# Install the local CA into the trust stores
mkcert -install

# Generate a certificate for your local registry host
mkcert localhost 127.0.0.1 ::1

Serve your local registry with the generated *.pem files and npm will trust them with no further configuration.

Prefer the trust-based fixes above. Only if you cannot obtain or install the certificate (for example, a throwaway local test) should you temporarily turn off verification. This disables TLS certificate checks entirely and exposes you to man-in-the-middle attacks, so never do this for production, shared, or CI machines, and re-enable it immediately afterward.

# Per-command (preferred - scoped, not persisted)
npm install --strict-ssl=false

# Or globally (remember to undo it)
npm config set strict-ssl false
# ...then re-enable:
npm config set strict-ssl true