Node "self signed certificate in certificate chain" (MITM proxy) in CI

By Kaveh Alemi·Latchkey

A TLS-intercepting proxy re-signs traffic with a corporate root CA. Node validates the chain, reaches that root, and does not find it in its trust store, so it reports a self signed certificate in the chain. The right fix is to trust the corporate root, not to disable verification.

What this error means

Node tools (npm, node-fetch, axios) fail with "unable to verify the first certificate" or "SELF_SIGNED_CERT_IN_CHAIN: self signed certificate in certificate chain" behind a corporate proxy.

Error: self signed certificate in certificate chain
    at TLSSocket.onConnectSecure (node:_tls_wrap:1550:34)
  code: 'SELF_SIGNED_CERT_IN_CHAIN'

Common causes

A MITM proxy re-signs TLS with an untrusted root

The inspecting proxy substitutes its own certificate signed by a private corporate CA that is absent from Node's bundled roots.

The corporate root is not exposed to Node

Even if the OS trusts the CA, Node uses its own bundled roots unless you point NODE_EXTRA_CA_CERTS at the corporate certificate.

How to fix it

Trust the corporate root via NODE_EXTRA_CA_CERTS

1. Obtain the corporate root CA in PEM format.
2. Set NODE_EXTRA_CA_CERTS to its path for every Node step.
3. Re-run; the chain now validates without weakening TLS.

env:
  NODE_EXTRA_CA_CERTS: /etc/ssl/certs/corp-root-ca.pem

Point npm at the same CA file

npm reads its own TLS config; set the CA file so registry requests also validate against the corporate root.

npm config set cafile /etc/ssl/certs/corp-root-ca.pem

How to prevent it

• Bake the corporate root CA into the runner image and export NODE_EXTRA_CA_CERTS.
• Avoid NODE_TLS_REJECT_UNAUTHORIZED=0; it disables verification for the whole process.
• Keep one canonical CA bundle path used by Node, npm, and system tools.

Frequently asked questions

Related guides

References

• GitHub Actions documentation