Node.js "SELF_SIGNED_CERT_IN_CHAIN" in CI

By Kaveh Alemi·Latchkey

Node followed the chain to a self-signed root that is not in its trust store, and threw SELF_SIGNED_CERT_IN_CHAIN. On a CI runner this almost always means a corporate TLS-inspecting proxy or an internal CA re-signs the traffic. The fix is to add that root to Node's trust via NODE_EXTRA_CA_CERTS, not to turn off verification.

What this error means

A Node HTTPS call or npm install fails with "Error: self-signed certificate in certificate chain" and code: 'SELF_SIGNED_CERT_IN_CHAIN'.

Error: self-signed certificate in certificate chain
    at TLSSocket.onConnectSecure (node:_tls_wrap:1544:34)
  code: 'SELF_SIGNED_CERT_IN_CHAIN'

Common causes

A corporate proxy re-signs TLS with a self-signed root

The MITM proxy root that terminates TLS is not in Node's bundled or system trust, so the chain fails.

An internal CA root is missing on the runner

Your own CA root is not provided to Node, so an otherwise valid internal chain is rejected.

How to fix it

Trust the root via NODE_EXTRA_CA_CERTS

1. Add the proxy or internal root to the system CA store.
2. Export NODE_EXTRA_CA_CERTS pointing at the bundle (or the single root PEM).
3. Re-run the Node process or npm install.

sudo cp corp-root.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt

Point npm at the same CA

Configure npm to use the CA file so registry installs validate through the proxy too.

npm config set cafile /etc/ssl/certs/ca-certificates.crt

How to prevent it

• Ship the proxy or internal CA root in runner images.
• Set NODE_EXTRA_CA_CERTS globally so every Node step trusts it.
• Keep npm cafile aligned with the system trust store.

Frequently asked questions

Related guides

References

• Node.js documentation
• npm CLI documentation
• GitHub Actions documentation