How to fix npm ERR! unable to verify the first certificate in npm

npmINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 154 views

The "unable to verify the first certificate" error occurs when npm cannot verify the SSL certificate chain. This typically means an intermediate certificate is missing from the chain sent by the server.

Quick fix

Fixes npm ERR! unable to verify the first certificate

openssl s_client -connect registry.npmjs.org:443 -showcerts 2>/dev/null
  1. Check the certificate chain
  2. Download intermediate certificates
  3. Configure npm with full chain
  4. Use NODE_EXTRA_CA_CERTS
npm — error
openssl s_client -connect registry.npmjs.org:443 -showcerts 2>/dev/null
npm ERR! unable to verify the first certificate

What this error means

This error indicates a problem with SSL certificate chain verification. When a server presents its certificate, it should also send any intermediate certificates needed to chain back to a trusted root CA. If these intermediates are missing, npm cannot verify the chain even if the root CA is trusted. This often happens with misconfigured proxies, load balancers, or CDNs that don't send the complete certificate chain. The "first certificate" refers to the server's leaf certificate that cannot be verified.

Typical symptoms

  • npm install fails with certificate verification error
  • Error mentions "first certificate" or "leaf signature"
  • Browser works fine but npm fails
  • Problem specific to corporate network
  • Same registry works from other machines
  • Error occurs intermittently

Common causes

  1. Proxy not forwarding intermediate certificates
  2. Corporate SSL inspection misconfigured
  3. Load balancer missing intermediate certs
  4. Server misconfiguration
  5. Outdated intermediate CA in system store
  6. CDN edge server configuration issue
  7. Antivirus stripping certificate chain

How to fix "npm ERR! unable to verify the first certificate"

1Check the certificate chain

View what certificates are being sent:

bash
openssl s_client -connect registry.npmjs.org:443 -showcerts 2>/dev/null

You should see multiple certificates. If only one, the chain is incomplete.

2Download intermediate certificates

Get missing intermediate certs:

1. Visit the site in a browser
2. Export the full certificate chain
3. Or find intermediates on the CA's website
4. Save as intermediate.pem

3Configure npm with full chain

Point npm to the complete certificate chain:

bash
# Create combined cert file
cat intermediate.pem root.pem > full-chain.pem

# Configure npm
npm config set cafile /path/to/full-chain.pem
4Use NODE_EXTRA_CA_CERTS

Add extra certificates via environment:

bash
export NODE_EXTRA_CA_CERTS=/path/to/intermediate.pem
npm install

Add to shell profile for persistence.

5Update CA certificates

Ensure system has latest intermediate CAs:

bash
# Ubuntu/Debian
sudo apt update && sudo apt install ca-certificates
sudo update-ca-certificates

# macOS
brew upgrade ca-certificates
6Report to IT/network team

If caused by corporate proxy:

1. Report the incomplete certificate chain
2. Ask them to configure proper cert chain
3. Request the full chain file as workaround

Advanced notes

This issue is common when organizations deploy SSL inspection without properly configuring intermediate certificates. Tools like SSL Labs (ssllabs.com/ssltest) can diagnose server-side chain issues. In Kubernetes, ensure ingress controllers and service meshes send complete chains. For Docker builds, use multi-stage builds that include proper CA configuration.

Frequently asked questions

What does "npm ERR! unable to verify the first certificate" mean?
This error indicates a problem with SSL certificate chain verification. When a server presents its certificate, it should also send any intermediate certificates needed to chain back to a trusted root CA. If these intermediates are missing, npm cannot verify the chain even if the root CA is trusted.
How do I fix "npm ERR! unable to verify the first certificate"?
The "unable to verify the first certificate" error occurs when npm cannot verify the SSL certificate chain. This typically means an intermediate certificate is missing from the chain sent by the server.
What causes "npm ERR! unable to verify the first certificate"?
Proxy not forwarding intermediate certificates Corporate SSL inspection misconfigured Load balancer missing intermediate certs
Is the "npm ERR! unable to verify the first certificate" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading