Skip to main content
Castov
Cloud & Security · Developer Error Resolution Lab

Fix 'unable to get local issuer certificate' in npm, Node.js, git and curl

Trust your corporate proxy or custom CA properly with NODE_EXTRA_CA_CERTS instead of disabling TLS verification.

Triggered Error Message:

npm ERR! code UNABLE_TO_GET_ISSUER_CERT_LOCALLY npm ERR! request to https://registry.npmjs.org/ failed, reason: unable to get local issuer certificate

Customize Solution for Your Environment
# Node.js / npm / npx
export NODE_EXTRA_CA_CERTS="/etc/ssl/certs/corp-root-ca.pem"
npm config set cafile "/etc/ssl/certs/corp-root-ca.pem"

# git
git config --global http.sslCAInfo "/etc/ssl/certs/corp-root-ca.pem"

# curl
curl --cacert "/etc/ssl/certs/corp-root-ca.pem" https://registry.npmjs.org/

# Node 23.8+ can also use the OS trust store:
NODE_OPTIONS="--use-system-ca" npm install

Root Cause & Mechanism Analysis

Why does this error occur?

A TLS-inspecting corporate proxy, antivirus, or self-signed internal server re-signs HTTPS traffic with a root CA that Node.js, npm, git, or curl do not trust. Node.js uses its own bundled CA store, not the operating system's.

Frequently Asked Questions

Where do I get the corporate CA file?
Export it from your browser's certificate viewer (the top certificate in the chain on any HTTPS site) or ask IT for the proxy's root CA in PEM format.
DEVSECOPS & CI/CD PARTNER2 Slots Open

Need Zero-Knowledge .env Secret Sync Across Your Engineering Team?

Explore Castov Env Vault for client-side AES-256-GCM encrypted environment sharing, or sponsor this engineering hub.

Try Team Env VaultSponsor Castov

Related Developer Error Solutions

Browse All 69 Guides
Network & HTTP

SSL: NET::ERR_CERT_AUTHORITY_INVALID

Resolve SSL/TLS certificate trust errors in development, curl, Node.js, and local HTTPS environments.

View fix guide
TypeScript & Node.js

npm ERR! code EACCES: permission denied, mkdir '/usr/local/lib/node_modules'

Stop using sudo npm. Reconfigure npm's global prefix or use a Node version manager so global installs and npx work without root.

View fix guide
Cloud & Security

SSH: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! Host key verification failed

Safely remove a stale host key from known_hosts after a server rebuild or IP reuse, and verify the new fingerprint before trusting it.

View fix guide