How to make Python, Node.js and npm trust a private CA

Before you start

• The root certificate of your private or corporate CA as a PEM file, for example corp-root.crt. Check its fingerprint first (Linux, Windows, macOS).
• Ideally, the root already added to your operating system’s store, because then two of the options below need no file at all.
• Python 3.10 or later for truststore; Node.js 22.15 or later for --use-system-ca.

Why it matters: Python’s requests and Node.js ship their own lists of public roots, so a root your browser trusts can still fail in code with CERTIFICATE_VERIFY_FAILED or UNABLE_TO_GET_ISSUER_CERT_LOCALLY.

Steps

1. Know where each one looks

2. Python: use the operating system’s store with truststore

If the root is already in the Windows, macOS or Linux store, truststore lets requests, urllib3 and the standard library verify through the operating system:

python -m pip install truststore

import truststore
truststore.inject_into_ssl()   # call once, at program start

import requests
print(requests.get("https://intranet.example.com/").status_code)

On our Ubuntu test machine, with the root in the system store, a pip-installed requests failed with CERTIFICATE_VERIFY_FAILED on its own, and printed 200 after inject_into_ssl().

3. Python: or point it at a bundle file

REQUESTS_CA_BUNDLE (for requests) replaces the default list. A file with only your root fixes internal sites and breaks public ones. On Windows we tested exactly that:

REQUESTS_CA_BUNDLE=corp-root.crt python -c "import requests; print(requests.get('https://pypi.org/simple/').status_code)"

requests.exceptions.SSLError: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /simple/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1028)')))

SSL_CERT_FILE (for ssl and urllib) replaces only OpenSSL’s default file. In our tests Python still trusted public sites through the Windows store on Windows, and through the default certificate folder on Ubuntu unless SSL_CERT_DIR pointed elsewhere too. Do not rely on either behaviour: use a bundle that holds the public roots and yours. On Linux, after adding the root to the system store, that is the system bundle:

export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt   # Debian, Ubuntu
export REQUESTS_CA_BUNDLE=/etc/pki/tls/certs/ca-bundle.crt     # RHEL family

Elsewhere, build one from certifi plus your root, outside the certifi folder (an upgrade replaces that file):

cat "$(python -c 'import certifi; print(certifi.where())')" corp-root.crt > ca-bundle-plus-corp.pem
export REQUESTS_CA_BUNDLE="$PWD/ca-bundle-plus-corp.pem"

With that file, both the internal test server and pypi.org returned 200. In code you can pass the same file explicitly: requests.get(url, verify="/path/ca-bundle-plus-corp.pem"). The requests documentation notes that prepared requests ignore REQUESTS_CA_BUNDLE unless you merge the environment settings.

4. pip

pip 24.2 and later already use the operating system’s store in addition to certifi, so adding the root to the OS store is usually enough. Against our test index, pip 26.2 failed with There was a problem confirming the ssl certificate before the root was in Ubuntu’s store, and reached the index after. For older pip, or a root that is not in the OS store:

python -m pip config set global.cert /path/ca-bundle-plus-corp.pem

PIP_CERT does the same for one shell or CI job.

5. Node.js: add your root, or use the system store

NODE_EXTRA_CA_CERTS adds the certificates in a PEM file to Node’s built-in list (Node.js), so public sites keep working. On Windows with Node.js 23.11:

NODE_EXTRA_CA_CERTS=corp-root.crt node -e "require('https').get('https://localhost:18444/', r => { console.log(r.statusCode); process.exit(0) }).on('error', e => console.log(e.code))"

200

Without the variable the same command printed UNABLE_TO_GET_ISSUER_CERT_LOCALLY. Node reads the variable only when the process starts, and only warns if the file is missing:

Warning: Ignoring extra certs from `nope.crt`, load failed: error:80000002:system library::No such file or directory

If the root is already in the operating system’s store, --use-system-ca adds that store instead (Node.js); the NODE_USE_SYSTEM_CA variable needs Node.js 22.19 or 24.6. With Node.js 24.22 on Ubuntu, these three forms all returned 200:

node --use-system-ca app.js
NODE_USE_SYSTEM_CA=1 node app.js
NODE_OPTIONS=--use-system-ca npm install

If your code passes a ca option to https or tls, Node uses only that list and ignores both settings. Include the defaults: ca: [...tls.rootCertificates, fs.readFileSync('corp-root.crt')].

6. npm, Yarn and pnpm

They run on Node.js, so NODE_EXTRA_CA_CERTS and NODE_OPTIONS=--use-system-ca work for them too. With npm 11.10:

npm error code UNABLE_TO_GET_ISSUER_CERT_LOCALLY
npm error request to https://localhost:18444/-/ping failed, reason: unable to get local issuer certificate

npm notice PING https://localhost:18444/
npm notice PONG 251ms

The first is npm ping without the variable, the second with it. npm’s own cafile setting trusts only the CAs in that file for the registry, so it must contain every root you need.

7. Make it stick

Put the variables where your programs start: your shell profile, an Environment= line in the systemd unit, ENV in the Dockerfile, or your CI’s variables.

Check it worked

python -c "import requests; print(requests.get('https://intranet.example.com/').status_code)"
node -e "require('https').get('https://intranet.example.com/', r => { console.log(r.statusCode); process.exit(0) })"

Both should print a status code, not an SSL error. Then test one public site, to prove you did not replace the public roots.

If something goes wrong

• Still CERTIFICATE_VERIFY_FAILED or SELF_SIGNED_CERT_IN_CHAIN. The variable is not set in the process that fails (a service, an IDE, a CI step), or the file is not the root that issued the server’s chain. Paste the chain into the chain checker below.
• UNABLE_TO_VERIFY_LEAF_SIGNATURE or “unable to get local issuer certificate” with the right root. The server leaves out its intermediate. Fix the server: build the full chain file.
• Public sites broke. Your bundle replaced the defaults (step 3) or your code sets ca (step 5).
• Hostname mismatch or ERR_TLS_CERT_ALTNAME_INVALID. Trust is fine; the server certificate lacks the name in its Subject Alternative Name.
• Behind a TLS-inspecting proxy. The root you need is the proxy’s: see corporate proxy certificates.

Try it: Chain checkerOpen the full tool

Runs in your browser. Nothing you paste is sent anywhere.

Paste the chain

Try a sampleChoose a sample…A complete chain: leaf, intermediate and rootA server that forgets its intermediateA chain in the wrong orderA self-signed root CA

-----BEGIN CERTIFICATE----- MIIC1zCCAnygAwIBAgIQWTTOzqWiPshGdQhNb6kmNjAKBggqhkjOPQQDAjB+MQsw CQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UECxMe U2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSswKQYDVQQDEyJQS0kgWmVy byB0byBIZXJvIFNhbXBsZSBJc3N1aW5nIENBMB4XDTI2MTAwMTAwMDAwMFoXDTM2 MTAwMTAwMDAwMFowGjEYMBYGA1UEAxMPd3d3LmV4YW1wbGUuY29tMFkwEwYHKoZI zj0CAQYIKoZIzj0DAQcDQgAEw4og6Y/SOr+WrqSv+ng7tOBEsc5N3A3yZRk+9hsR XzPQvB9672aHZHTYFNlSY93RWVcTRieE+8XnIbWIYfwxIqOCAT4wggE6MAwGA1Ud EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcG A1UdEQQgMB6CD3d3dy5leGFtcGxlLmNvbYILZXhhbXBsZS5jb20wHQYDVR0OBBYE FALMipe4vcXJTpwO926S15Y/bobzMB8GA1UdIwQYMBaAFN+ph37v40SN23r6Fg/z OvSNjJqeMEgGCCsGAQUFBwEBBDwwOjA4BggrBgEFBQcwAoYsaHR0cDovL3BraS5l eGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcnQwPQYDVR0fBDYwNDAyoDCg LoYsaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtaXNzdWluZy1jYS5jcmww EwYDVR0gBAwwCjAIBgZngQwBAgEwCgYIKoZIzj0EAwIDSQAwRgIhAM5dJUPhL+qV artvWtQinfnykhVflJTjMXe8M6PnqQfaAiEAhOLGj1hSEkNxQoMrYNXRaIe69nq6 2unibVFSVw1AC80= -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIE2TCCAsGgAwIBAgIQPh9PeiGf4STnEQriHxExjDANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMB4XDTI1MDEwMTAwMDAwMFoXDTQw MDEwMTAwMDAwMFowfjELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEFBLSSBaZXJvIHRv IEhlcm8xJzAlBgNVBAsTHlNhbXBsZXMgLSBub3QgcHVibGljbHkgdHJ1c3RlZDEr MCkGA1UEAxMiUEtJIFplcm8gdG8gSGVybyBTYW1wbGUgSXNzdWluZyBDQTBZMBMG ByqGSM49AgEGCCqGSM49AwEHA0IABBFqObJ/j93aHrAuebO5+KWnj0xRFzUS8/Jh Idj6jR/p4zqaNT8+gOqxZ+zhpNO/weIpz/nzXjQ7RJS+EebYRNijggEfMIIBGzAS BgNVHRMBAf8ECDAGAQH/AgEAMA4GA1UdDwEB/wQEAwIBhjAdBgNVHSUEFjAUBggr BgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFN+ph37v40SN23r6Fg/zOvSNjJqe MB8GA1UdIwQYMBaAFIVx1Hy1TuED0pMkxEcdM+DWWPGiMEUGCCsGAQUFBwEBBDkw NzA1BggrBgEFBQcwAoYpaHR0cDovL3BraS5leGFtcGxlLmNvbS9zYW1wbGUtcm9v dC1jYS5jcnQwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL3BraS5leGFtcGxlLmNv bS9zYW1wbGUtcm9vdC1jYS5jcmwwEwYDVR0gBAwwCjAIBgZngQwBAgEwDQYJKoZI hvcNAQELBQADggIBAFa8c1kEzTTPW2aPDRPb3+OQc8GTgwpZV0pWNR3e6X8mJi7A D/RGrz4t354IwGzTts+tX23sY3fORKST3/BkqeHZwAZHvGNWi0+Co342eo2BySxo bcyy31AJBSSHOC2b7KJ11coMX++bvaHgtwOloy6DnHRDYIFwWRHg91wo1MKJGNVb OQH0vmqn6YPDLZ4BYL8VHOVtlRddBwd6bKyyp3Lw0MEMgfmg87Yd/U0yRZFaLKNb b5vgDg7n+J1ozFwvumQlN6WVEyPsQdvI73K5bgMHkUeeUQ6j9KOeDMZMjbqQSC8x 1khcyT/qhqZLDJIHvmWS11FcYaLQUuvQiAzQieTNIuOM8WJw95LlxYSNIkZeOuLf f+JboiuT1cmqmvdbngAXtBIWRJ+Byeqdq2Z0d8Xfln6gWhHmm93+DO5uTaTxBwTr DayFTdTFxBZydXs48S+I/rVQvQtwkRh3rOcZpwTMsGzfoiCsOhEaiBOFk0C5FEKi um55SDXCMR6yXDhWqFPBIdle4izj5g2YmuZ3YD4G3PlcX5okW7aKTNU3RGWEOMk3 Ob9bkPnCsY7Ei4OqDqTBt/8HH/2kA4om4RzKGLw5Zc/Y+KhpbFhT52gtL7WDEEVZ NqFHgi6fdHgsczFNpCKhC8vM+mAM/gBiVR8hYIpt5lPFyXpFJO5Wn5BcEkv3 -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFxDCCA6ygAwIBAgIQV3/H8mpwNp5raCafwOtSezANBgkqhkiG9w0BAQsFADB7 MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8gdG8gSGVybzEnMCUGA1UE CxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVkMSgwJgYDVQQDEx9QS0kg WmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMCAXDTI1MDEwMTAwMDAwMFoYDzIw NTAwMTAxMDAwMDAwWjB7MQswCQYDVQQGEwJCRTEZMBcGA1UEChMQUEtJIFplcm8g dG8gSGVybzEnMCUGA1UECxMeU2FtcGxlcyAtIG5vdCBwdWJsaWNseSB0cnVzdGVk MSgwJgYDVQQDEx9QS0kgWmVybyB0byBIZXJvIFNhbXBsZSBSb290IENBMIICIjAN BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnYTGHkYMca54QPkZcZENin3BHB3t uKdHkDZeKZvJHWqpfXpcZfusLvtJFeTrwWlEDBJuV20vmhaLeV29QeYKaIkm1Ul2 qCkrLUpWn/W9CPosfVqMd1nOrd+Ka9iPSeKlW3YX1P5WqQEjieJhBzT9comdj8qN /PynceTDcLa2mgYw7QhU8trBoLzhYqIJFfoUBk+7lahae8b9G5wKCbDicRM8/ATt 0dO9jCxi6RxJpkKl24ULgNOuFP9gG4nubWA8+BaMeM0LU64wNciFofgM2g/3iHHn zmcoe1z80C7WN+GuzNkWkN8D/tcqrbua0O5fREKKw6PyyxwQsjeMghpxLb0h1KeA ihpQMVgpWbhRkkpvF5odkF9vTJP89Z2y+8cgnUMyTpXATrt8KgC5LdWo5mlTNXC/ MvbCUb1Vz9bvcEx2y29tUeLIAUmyBzhF7zgMUPAOtDbLLCuxgR78T2TWaXB/8WBT XL44Wk5rOe7U+KuBr/t12AcZjaq0AGiNsvfd1P+IFbRivElegpdrM+S3arjOjptP M9sUl9Hc+cszaTpEVcQFFxcIyvq5HVjTlZr4vLKdqlhSkQB9hZUFuWNpnUZEYEnA 1vn/GkHNTJ6pv8XxdNXkFeRaUv3ajCn7CQ3UP/EXJqzBw5fl6aa9lqKTS5kF9rgw EIhwNaSd2O557KUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E BAMCAQYwHQYDVR0OBBYEFIVx1Hy1TuED0pMkxEcdM+DWWPGiMA0GCSqGSIb3DQEB CwUAA4ICAQBMdaOOM84aoItvumQ/sNzOhXvmLwboTb3oe67wda9TvPMSf2aP3JtP UWsR/9UbZgNE9M41p2+XZlVpsGP1BLEvi5ZwfMWmR876Mw1Zkt8ouY3DWN08egnm IdV2vKwDHhDE93IQ12fjNc8iuMCasoYiXTsmXx3R/+PkNbeBAupZEk6EwTr75PCY IJ2cheL7jQ06xeCCZv815rG+63jGk3tys7A+nUXKqOp9oN/dkEhi+YWiHG9UJ2w/ BDZCFUUoJBia7C3+hcXZAVxtWwTy0A5T/plEsqGcdfCMFA4cOFstthyS/Wnnuw8y cpSiXdUAQbLkJ+CGavr6MXVmDicmnV9p3Pv9EbpGPV8UlxwvoQMf+ajEE4EAaJkN Gc85wOC7Y7wwWkBnzjiyLztqRqOFdHEdM13V+2Gw2545Jk8o2gRizBQ6Ey6rlt2u YdYFqFFQhe2H+VqvJiLKefkN1mVQhvhfAvuoxZWIsDtyJWGs12L06xMj3wG98kne mUJjPzze3swZU39eiaC1MBs6U0oLZE6ZqubmjJd/ppmGyK+7o2SMi0juouvw6rcA J9eUJQLNpiVKmiwzKvPejASpunK5B5JO3Y7NAb4SVU22ItR73bBiRAugPwVajlBN RGcjMkDSiW07/dhN6GgjsNAzXHcTR7/nbILOAWbhBstNFK1mgejlbQ== -----END CERTIFICATE-----

Every certificate the server sends, leaf first. The output of openssl s_client -showcerts -connect example.com:443 works as it is: we ignore the text around the certificates.

Check the chainClearChoose a file

Why this works

Each runtime builds a certificate chain from the server’s certificate to one of the roots it loaded, and the libraries differ only in where those roots come from. The options above add your root to that list, or swap the list for the operating system’s, while verification stays fully on. Why so many stores exist is in Who do we trust?, and how the chain is checked is in Certificate chains and path validation.

Go deeper

• Python ssl: load_default_certs: what the standard library loads on each platform.
• Requests: SSL certificate verification: verify and REQUESTS_CA_BUNDLE.
• truststore: using the operating system’s store from Python.
• pip: HTTPS certificates: system certificates since pip 24.2, --cert and PIP_CERT.
• Node.js command-line options: NODE_EXTRA_CA_CERTS, --use-system-ca and NODE_USE_SYSTEM_CA.
• npm config: ca, cafile and strict-ssl.