SELF_SIGNED_CERT_IN_CHAIN

Where you see it

In Node.js HTTPS clients and, very often, in npm install on a company network. The code comes from OpenSSL’s verify error 19; Node.js lists these codes in its TLS documentation.

node:events:485
      throw er; // Unhandled 'error' event
      ^

Error: self-signed certificate in certificate chain
    at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
    at TLSSocket.emit (node:events:507:28)
    at TLSSocket._finishInit (node:_tls_wrap:1078:8)
    at ssl.onhandshakedone (node:_tls_wrap:864:12)
...
  code: 'SELF_SIGNED_CERT_IN_CHAIN'
}

$ npm install
npm error code SELF_SIGNED_CERT_IN_CHAIN
npm error errno SELF_SIGNED_CERT_IN_CHAIN
npm error request to https://registry.npmjs.org/express failed, reason: self-signed certificate in certificate chain

Older npm versions print npm ERR! instead of npm error.

What it means

Every chain ends in a root certificate, which signs itself. A root is trusted only because it is already in the client’s trust store. Here the server sent the whole chain including a self-signed root, and that root is not among the roots Node.js trusts. Node.js uses its own bundled list of public roots by default, not the operating system’s store, so a root that IT installed on your laptop may be missing for Node.js only.

Likely causes

A TLS-inspection proxy re-signs your traffic

If this happens for registry.npmjs.org or other public sites on a company network, a TLS-inspection proxy or antivirus product is decrypting HTTPS and re-signing it. Check the issuer:

openssl s_client -connect registry.npmjs.org:443 -servername registry.npmjs.org </dev/null 2>/dev/null | openssl x509 -noout -issuer

If it names your company or a security product instead of a public CA, get that root certificate from IT in PEM format and trust it:

export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/corp-root.pem
npm install

NODE_EXTRA_CA_CERTS adds certificates to Node.js’s built-in roots when the process starts, so public sites keep working (Node.js CLI documentation). Set it in your shell profile, CI variables or Dockerfile:

COPY corp-root.pem /usr/local/share/ca-certificates/corp-root.crt
RUN update-ca-certificates
ENV NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root.crt

Node.js can also trust the operating system’s store, where IT usually deploys the proxy root: start it with --use-system-ca (Node.js 22.15 and 23.8 on Windows and macOS, 23.9 on other platforms), or set NODE_USE_SYSTEM_CA=1 (Node.js 22.19 and 24.6).

The server uses a private CA

Internal registries, Git servers and APIs often use a company CA. List what the server sends:

openssl s_client -connect npm.example.com:443 -servername npm.example.com -showcerts </dev/null 2>/dev/null | grep -E '^ [0-9]+ s:|^   i:'

The last entry has the same subject (s:) and issuer (i:): that is the root. Get it from your PKI team through a trusted channel, compare its SHA-256 fingerprint (openssl x509 -in corp-root.pem -noout -fingerprint -sha256), and add it with NODE_EXTRA_CA_CERTS as above.

For npm only, npm config set cafile /path/to/bundle.pem also works, but the file replaces npm’s built-in roots (npm config documentation), so it must contain the public roots as well, or the public registry fails with UNABLE_TO_GET_ISSUER_CERT_LOCALLY. When a ca is set, Node.js also ignores NODE_EXTRA_CA_CERTS for those connections.

Your Node.js is old

Each Node.js release bundles a snapshot of public roots. A very old version may lack a newer public root. Upgrade Node.js to a supported release.

Related: DEPTH_ZERO_SELF_SIGNED_CERT

If the code is DEPTH_ZERO_SELF_SIGNED_CERT (message self-signed certificate), the server sent a single self-signed certificate with no CA at all, typical of a development server. Replace it with a certificate from your company CA or a public CA. For a local test, trust exactly that certificate with NODE_EXTRA_CA_CERTS or the ca option.

Check yours

Try it: Chain checkerOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste the chain

Try a sampleChoose a sample…A complete chain: leaf, intermediate and rootA server that forgets its intermediateA chain in the wrong orderA self-signed root CA

-----BEGIN CERTIFICATE----- MIIFxDCCA6ygAwIBAgIQV3/H8mpwNp5raCafwOtSezANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMCAXDTI1MDEwMTAwMDAwMFoYDzIw NTAwMTAxMDAwMDAwWjB7MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8g dG8gSGVybzEnMCUGA1UECxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVk MSgwJgYDVQQDEx9QS0kgWmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMIICIjAN BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnYTGHkYMca54QPkZcZENin3BHB3t uKdHkDZeKZvJHWqpfXpcZfusLvtJFeTrwWlEDBJuV20vmhaLeV29QeYKaIkm1Ul2 qCkrLUpWn/W9CPosfVqMd1nOrd+Ka9iPSeKlW3YX1P5WqQEjieJhBzT9comdj8qN /PynceTDcLa2mgYw7QhU8trBoLzhYqIJFfoUBk+7lahae8b9G5wKCbDicRM8/ATt 0dO9jCxi6RxJpkKl24ULgNOuFP9gG4nubWA8+BaMeM0LU64wNciFofgM2g/3iHHn zmcoe1z80C7WN+GuzNkWkN8D/tcqrbua0O5fREKKw6PyyxwQsjeMghpxLb0h1KeA ihpQMVgpWbhRkkpvF5odkF9vTJP89Z2y+8cgnUMyTpXATrt8KgC5LdWo5mlTNXC/ MvbCUb1Vz9bvcEx2y29tUeLIAUmyBzhF7zgMUPAOtDbLLCuxgR78T2TWaXB/8WBT XL44Wk5rOe7U+KuBr/t12AcZjaq0AGiNsvfd1P+IFbRivElegpdrM+S3arjOjptP M9sUl9Hc+cszaTpEVcQFFxcIyvq5HVjTlZr4vLKdqlhSkQB9hZUFuWNpnUZEYEnA 1vn/GkHNTJ6pv8XxdNXkFeRaUv3ajCn7CQ3UP/EXJqzBw5fl6aa9lqKTS5kF9rgw EIhwNaSd2O557KUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E BAMCAQYwHQYDVR0OBBYEFIVx1Hy1TuED0pMkxEcdM+DWWPGiMA0GCSqGSIb3DQEB CwUAA4ICAQBMdaOOM84aoItvumQ/sNzOhXvmLwboTb3oe67wda9TvPMSf2aP3JtP UWsR/9UbZgNE9M41p2+XZlVpsGP1BLEvi5ZwfMWmR876Mw1Zkt8ouY3DWN08egnm IdV2vKwDHhDE93IQ12fjNc8iuMCasoYiXTsmXx3R/+PkNbeBAupZEk6EwTr75PCY IJ2cheL7jQ06xeCCZv815rG+63jGk3tys7A+nUXKqOp9oN/dkEhi+YWiHG9UJ2w/ BDZCFUUoJBia7C3+hcXZAVxtWwTy0A5T/plEsqGcdfCMFA4cOFstthyS/Wnnuw8y cpSiXdUAQbLkJ+CGavr6MXVmDicmnV9p3Pv9EbpGPV8UlxwvoQMf+ajEE4EAaJkN Gc85wOC7Y7wwWkBnzjiyLztqRqOFdHEdM13V+2Gw2545Jk8o2gRizBQ6Ey6rlt2u YdYFqFFQhe2H+VqvJiLKefkN1mVQhvhfAvuoxZWIsDtyJWGs12L06xMj3wG98kne mUJjPzze3swZU39eiaC1MBs6U0oLZE6ZqubmjJd/ppmGyK+7o2SMi0juouvw6rcA J9eUJQLNpiVKmiwzKvPejASpunK5B5JO3Y7NAb4SVU22ItR73bBiRAugPwVajlBN RGcjMkDSiW07/dhN6GgjsNAzXHcTR7/nbILOAWbhBstNFK1mgejlbQ== -----END CERTIFICATE-----

Every certificate the server sends, leaf first. The output of openssl s_client -showcerts -connect example.com:443 works as it is: we ignore the text around the certificates.

Check the chainClearChoose a file

Paste every certificate from openssl s_client -showcerts. The checker marks the self-signed root, explains when a client would trust it, and points out root names that belong to known HTTPS-inspection products.

Learn why

• Who do we trust? CAs, trust stores and self-signed certificates: why each runtime has its own store.
• Related: npm UNABLE_TO_GET_ISSUER_CERT_LOCALLY, curl: self-signed certificate in certificate chain.

In the gameLevel 12: Who do we trust?Registry of Roots, Keystone. In development