Node.js "UNABLE_TO_VERIFY_LEAF_SIGNATURE" in CI
Node's TLS stack could not verify the leaf certificate because the server did not send the intermediate that chains it to a trusted root. The code is UNABLE_TO_VERIFY_LEAF_SIGNATURE, the Node equivalent of OpenSSL return code 21. The right fix is to serve the full chain from the endpoint, or point Node at the missing CA via NODE_EXTRA_CA_CERTS.
What this error means
A Node HTTPS request throws "Error: unable to verify the first certificate" with code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE', while a browser that caches intermediates loads the same URL.
Error: unable to verify the first certificate
at TLSSocket.onConnectSecure (node:_tls_wrap:1544:34)
code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'Common causes
The server omits an intermediate certificate
The endpoint presents only the leaf, so Node cannot build a path to a trusted root. Browsers hide this by caching intermediates; Node does not.
A required CA is not on the Node trust path
The chain relies on a CA (for example a proxy or internal root) that Node's bundled roots do not include.
How to fix it
Serve the full chain from the endpoint
- Rebuild the endpoint certificate as leaf plus intermediates.
- Redeploy so Node receives a complete chain.
- Re-run the request to confirm it verifies.
# concatenate leaf then intermediates for the server
cat leaf.crt intermediate.crt > fullchain.pemAdd the missing CA with NODE_EXTRA_CA_CERTS
When the CA is internal or you cannot fix the server, load it into Node's trust store via the env var.
export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
node fetch.jsHow to prevent it
- Deploy full certificate chains on all HTTPS endpoints Node calls.
- Set NODE_EXTRA_CA_CERTS in CI when internal or proxy CAs are involved.
- Do not set NODE_TLS_REJECT_UNAUTHORIZED=0 as a permanent workaround.