How to fix npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID npm ERR! Hostname/IP does not match certificate's altnames in npm

npmINTERMEDIATEHIGHUpdated Dec 5, 2025· 159 views

This error occurs when npm can't verify the SSL certificate for the registry because the hostname doesn't match the certificate's Subject Alternative Names (SAN). It's commonly caused by DNS issues, corporate proxies, or system clock misalignment.

Quick fix

Fixes npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID npm ERR! Hostname/IP does not match certificate's altnames

w32tm /resync
  1. Verify your system clock is accurate
  2. Try using a public DNS resolver
  3. Update npm and Node.js to latest versions
  4. Check and reset npm registry configuration
npm — error
w32tm /resync
npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID
npm ERR! Hostname/IP does not match certificate's altnames

What this error means

The ERR_TLS_CERT_ALTNAME_INVALID error is a TLS (Transport Layer Security) validation failure. When npm tries to connect to registry.npmjs.org over HTTPS, it verifies that the server's SSL certificate is valid for that exact hostname. If the certificate is issued to a different hostname (like a.sni.fastly.net or your corporate proxy), the validation fails and npm refuses to proceed. This is actually a security feature designed to prevent man-in-the-middle attacks. The certificate's Subject Alternative Name field must include the hostname you're connecting to. When there's a mismatch, npm treats it as a potential security threat and blocks the connection.

Typical symptoms

  • All npm install commands fail with the ERR_TLS_CERT_ALTNAME_INVALID error message
  • The error message shows registry.npmjs.org but mentions a different hostname in the certificate
  • The issue only occurs inside Docker containers or on specific networks but works on your host machine
  • Commands work from personal WiFi but fail on corporate/office networks
  • Recently traveled across time zones and started experiencing the error

Common causes

  1. DNS misconfiguration or ISP caching causing registry.npmjs.org to resolve to wrong IP addresses
  2. Corporate proxy or firewall performing deep SSL inspection, intercepting HTTPS traffic with its own certificate
  3. System clock severely out of sync, causing SSL certificate time validation to fail
  4. Using an outdated version of npm or Node.js with incomplete or broken SSL validation
  5. Docker container using a different network configuration or DNS resolver than the host machine

How to fix "npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID npm ERR! Hostname/IP does not match certificate's altnames"

1Verify your system clock is accurate

SSL certificates have validity dates, and if your system time is incorrect, certificate validation fails. Check and sync your system clock:

On Windows:

bash
w32tm /resync

On macOS:

bash
sudo sntp -sS time.apple.com

On Linux:

bash
date
sudo ntpdate -s time.nist.gov
# or
sudo timedatectl set-ntp on
2Try using a public DNS resolver

DNS misconfiguration or ISP caching can cause registry.npmjs.org to resolve incorrectly. Switch to a public DNS provider:

On Windows:
Open Settings > Network > Change adapter options > Properties
Set IPv4 DNS to 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare)

Or use environment variables temporarily:

bash
NODE_OPTIONS="--dns-result-order=ipv4first" npm install

Wait 15-30 minutes for local DNS caches to clear, then retry the npm command.

3Update npm and Node.js to latest versions

Old versions of npm may have incomplete SSL validation or known issues with certificate handling.

bash
npm install -g npm@latest

npm --version
node --version

After updating, clear the npm cache:

bash
npm cache clean --force
4Check and reset npm registry configuration

Ensure npm is pointing to the correct registry and has proper SSL settings:

bash
npm config get registry

# Should output: https://registry.npmjs.org/
# If not, reset it:
npm config set registry https://registry.npmjs.org/

# Verify strict-ssl is enabled
npm config get strict-ssl
# Should output: true

If you previously disabled strict SSL, re-enable it:

bash
npm config set strict-ssl true
5Configure npm for corporate proxy environments

If you're behind a corporate proxy with SSL inspection, you need to configure npm to trust your corporate CA certificate:

bash
npm config set proxy http://your-proxy.company.com:8080
npm config set https-proxy http://your-proxy.company.com:8080

# Point npm to your corporate CA certificate file
npm config set cafile /path/to/corporate-ca.pem

Or create a .npmrc file:

bash
registry=https://registry.npmjs.org/
proxy=http://proxy.company.com:8080
https-proxy=http://proxy.company.com:8080
cafile=/path/to/corporate-ca.pem
strict-ssl=true

Advanced notes

In Docker environments, the container's DNS resolution or certificate store may differ from the host. Ensure your Docker image has updated CA certificates: RUN apt-get update && apt-get install -y ca-certificates (Debian/Ubuntu). Disabling strict SSL verification using npm config set strict-ssl false or NODE_TLS_REJECT_UNAUTHORIZED=0 is a temporary workaround but exposes you to man-in-the-middle attacks and should only be used for debugging in isolated development environments.

Frequently asked questions

What does "npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID npm ERR! Hostname/IP does n" mean?
The ERR_TLS_CERT_ALTNAME_INVALID error is a TLS (Transport Layer Security) validation failure. org over HTTPS, it verifies that the server's SSL certificate is valid for that exact hostname. net or your corporate proxy), the validation fails and npm refuses to proceed.
How do I fix "npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID npm ERR! Hostname/IP does n"?
This error occurs when npm can't verify the SSL certificate for the registry because the hostname doesn't match the certificate's Subject Alternative Names (SAN). It's commonly caused by DNS issues, corporate proxies, or system clock misalignment.
What causes "npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID npm ERR! Hostname/IP does n"?
DNS misconfiguration or ISP caching causing registry.npmjs.org to resolve to wrong IP addresses Corporate proxy or firewall performing deep SSL inspection, intercepting HTTPS traffic with its own certificate System clock severely out of sync, causing SSL certificate time validation to fail
Is the "npm ERR! code ERR_TLS_CERT_ALTNAME_INVALID npm ERR! Hostname/IP does n" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading