How to fix npm ERR! unable to get issuer certificate in npm

npmINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 237 views

The "unable to get issuer certificate" error occurs when npm cannot verify the SSL/TLS certificate chain for the registry. This is commonly caused by corporate proxies performing SSL inspection or missing CA certificates.

Quick fix

Fixes npm ERR! unable to get issuer certificate

openssl s_client -connect registry.npmjs.org:443 -showcerts
  1. Identify the certificate being used
  2. Get the corporate CA certificate
  3. Configure npm to use the CA certificate
  4. Add CA to system trust store (better solution)
npm — error
openssl s_client -connect registry.npmjs.org:443 -showcerts
npm ERR! unable to get issuer certificate

What this error means

This SSL/TLS error indicates that npm received a certificate from the registry but cannot verify it because the issuer (Certificate Authority) certificate is not in the trusted certificate store. The certificate chain is incomplete - npm has the end certificate but cannot trace it back to a trusted root CA. This commonly happens in corporate environments where a proxy intercepts HTTPS traffic and re-signs it with a corporate CA certificate that is not in Node.js's trust store.

Typical symptoms

  • npm install fails with SSL certificate error
  • Error mentions certificate chain or issuer
  • Works on home network but not corporate
  • Browser can access registry but npm cannot
  • Problem affects all npm registry operations
  • Error appears after VPN connection

Common causes

  1. Corporate proxy performing SSL inspection
  2. Missing intermediate CA certificates
  3. Corporate CA not in Node.js trust store
  4. Outdated CA certificate bundle
  5. Man-in-the-middle proxy
  6. Self-signed certificates in the chain
  7. Antivirus software intercepting HTTPS

How to fix "npm ERR! unable to get issuer certificate"

1Identify the certificate being used

Check what certificate npm is receiving:

bash
openssl s_client -connect registry.npmjs.org:443 -showcerts

Look at the certificate chain. If it shows your company's name, you're behind an SSL-inspecting proxy.

2Get the corporate CA certificate

Export the CA certificate from your browser:

1. Open https://registry.npmjs.org in browser
2. Click the lock icon > Certificate > Details
3. Find the root CA certificate
4. Export as PEM/CRT format
5. Save as corporate-ca.crt

3Configure npm to use the CA certificate

Add the corporate CA to npm's trusted certificates:

bash
npm config set cafile /path/to/corporate-ca.crt

Or set via environment variable:

bash
export NODE_EXTRA_CA_CERTS=/path/to/corporate-ca.crt
4Add CA to system trust store (better solution)

Add the corporate CA system-wide:

bash
# Ubuntu/Debian
sudo cp corporate-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# CentOS/RHEL
sudo cp corporate-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

# macOS
sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain corporate-ca.crt
5Disable strict SSL (not recommended)

As a last resort for testing only:

bash
npm config set strict-ssl false

⚠️ This disables certificate verification entirely and should only be used temporarily. It exposes you to man-in-the-middle attacks.

6Use company npm registry

Many companies provide internal npm mirrors:

bash
npm config set registry https://npm.internal.company.com

This often bypasses SSL inspection issues.

Advanced notes

In CI/CD pipelines, mount the corporate CA certificate and set NODE_EXTRA_CA_CERTS. For Docker builds, use a base image that includes your corporate CAs or COPY the certificate and run update-ca-certificates. Some proxy solutions like Zscaler or corporate firewalls require specific client certificates - work with your IT security team. Never distribute strict-ssl=false configurations to production systems.

Frequently asked questions

What does "npm ERR! unable to get issuer certificate" mean?
This SSL/TLS error indicates that npm received a certificate from the registry but cannot verify it because the issuer (Certificate Authority) certificate is not in the trusted certificate store. The certificate chain is incomplete - npm has the end certificate but cannot trace it back to a trusted root CA. js's trust store.
How do I fix "npm ERR! unable to get issuer certificate"?
The "unable to get issuer certificate" error occurs when npm cannot verify the SSL/TLS certificate chain for the registry. This is commonly caused by corporate proxies performing SSL inspection or missing CA certificates.
What causes "npm ERR! unable to get issuer certificate"?
Corporate proxy performing SSL inspection Missing intermediate CA certificates Corporate CA not in Node.js trust store
Is the "npm ERR! unable to get issuer certificate" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading