How to fix npm ERR! SELF_SIGNED_CERT_IN_CHAIN in npm

npmINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 264 views

The "self signed certificate" error occurs when npm encounters an SSL certificate that was not issued by a trusted Certificate Authority. This commonly happens with corporate proxies, private registries, or misconfigured networks.

Quick fix

Fixes npm ERR! SELF_SIGNED_CERT_IN_CHAIN

openssl s_client -connect registry.npmjs.org:443 -showcerts 2>/dev/null | openssl x509 -noout -issuer -subject
  1. Identify the self-signed certificate
  2. Export the certificate
  3. Add certificate to npm
  4. Add to system certificate store
npm — error
openssl s_client -connect registry.npmjs.org:443 -showcerts 2>/dev/null | openssl x509 -noout -issuer -subject
npm ERR! SELF_SIGNED_CERT_IN_CHAIN

What this error means

This error indicates that somewhere in the SSL certificate chain, npm encountered a self-signed certificate - one that was signed by itself rather than a trusted Certificate Authority. SSL/TLS security relies on a chain of trust from the server's certificate back to a trusted root CA. Self-signed certificates break this chain because there's no third-party verification. While self-signed certificates can be legitimate (corporate CAs, development environments), npm rejects them by default to protect against man-in-the-middle attacks.

Typical symptoms

  • npm install fails with SELF_SIGNED_CERT_IN_CHAIN
  • Error occurs behind corporate network
  • Works at home but not at office
  • Private registry access fails
  • VPN connection triggers the error
  • Browser shows different certificate than expected

Common causes

  1. Corporate proxy with SSL inspection
  2. Private npm registry with self-signed cert
  3. Development/staging environment certificate
  4. Antivirus performing HTTPS scanning
  5. Network appliance intercepting traffic
  6. Misconfigured reverse proxy
  7. Expired or incorrectly configured corporate CA

How to fix "npm ERR! SELF_SIGNED_CERT_IN_CHAIN"

1Identify the self-signed certificate

Find out where the self-signed cert comes from:

bash
openssl s_client -connect registry.npmjs.org:443 -showcerts 2>/dev/null | openssl x509 -noout -issuer -subject

Compare the issuer - if it's your company, you need their CA certificate.

2Export the certificate

Get the certificate from your browser:

1. Visit https://registry.npmjs.org
2. Click padlock > Certificate
3. Go to Certification Path tab
4. Select the root certificate
5. Export to PEM format

Or via command line:

bash
openssl s_client -connect registry.npmjs.org:443 </dev/null 2>/dev/null | openssl x509 > cert.pem
3Add certificate to npm

Configure npm to trust the certificate:

bash
npm config set cafile /path/to/cert.pem

Or via environment variable:

bash
export NODE_EXTRA_CA_CERTS=/path/to/cert.pem
4Add to system certificate store

For permanent solution, add to system CA store:

bash
# Ubuntu/Debian
sudo cp cert.pem /usr/local/share/ca-certificates/custom-ca.crt
sudo update-ca-certificates

# CentOS/RHEL
sudo cp cert.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

# macOS
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain cert.pem
5For private registries

If using a private registry with self-signed cert:

bash
# Set the registry
npm config set registry https://private-registry.company.com

# Set its CA certificate
npm config set cafile /path/to/private-registry-ca.pem
6Disable SSL verification (last resort)

⚠️ Only for testing/development:

bash
npm config set strict-ssl false

Never use this in production or CI/CD - it disables all certificate verification.

Advanced notes

In enterprise environments, work with your IT/security team to get the corporate CA certificate properly installed on all developer machines. For CI/CD, include the CA certificate in your pipeline configuration or Docker images. If you control the private registry, consider getting a certificate from a public CA like Let's Encrypt instead of using self-signed certificates.

Frequently asked questions

What does "npm ERR! SELF_SIGNED_CERT_IN_CHAIN" mean?
This error indicates that somewhere in the SSL certificate chain, npm encountered a self-signed certificate - one that was signed by itself rather than a trusted Certificate Authority. SSL/TLS security relies on a chain of trust from the server's certificate back to a trusted root CA. Self-signed certificates break this chain because there's no third-party verification.
How do I fix "npm ERR! SELF_SIGNED_CERT_IN_CHAIN"?
The "self signed certificate" error occurs when npm encounters an SSL certificate that was not issued by a trusted Certificate Authority. This commonly happens with corporate proxies, private registries, or misconfigured networks.
What causes "npm ERR! SELF_SIGNED_CERT_IN_CHAIN"?
Corporate proxy with SSL inspection Private npm registry with self-signed cert Development/staging environment certificate
Is the "npm ERR! SELF_SIGNED_CERT_IN_CHAIN" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading