LightAtom

"Self-Signed Certificate in Certificate Chain": How to Fix It

A tool found a self-signed root in the server's certificate chain that it doesn't trust, typically a company or antivirus proxy that inspects HTTPS.

self signed certificate in certificate chain

The certificate chain ends in a root certificate that isn't in the tool's trusted list. Usually that root belongs to a proxy on your network that re-signs HTTPS traffic.

Quick checks

  • Are you behind a company proxy, VPN or antivirus that scans HTTPS?
  • Check the issuer: `openssl s_client -connect registry.npmjs.org:443 -servername registry.npmjs.org </dev/null | grep issuer`.

Fixes on Mac

  1. Trust the proxy's root for your tools

    1. Export the root from Keychain Access as PEM (or get it from IT).
    2. Node/npm: export NODE_EXTRA_CA_CERTS=~/certs/company-root.pem in ~/.zshrc.
    3. git: git config --global http.sslCAInfo ~/certs/company-root.pem.
    4. Python: point REQUESTS_CA_BUNDLE or pip config set global.cert at a bundle that includes the root.

  2. For your own self-signed server

    1. Prefer a real certificate (Let's Encrypt), or a local CA with mkcert for development.

Fixes on Windows

  1. Windows

    1. Use NODE_EXTRA_CA_CERTS, and git config --global http.sslBackend schannel to use the Windows store.

Other devices

  1. Containers

    1. Install the root in the image's trust store and rebuild.

Still not working?

Avoid strict-ssl false and NODE_TLS_REJECT_UNAUTHORIZED=0. If the root isn't from your organisation, something unexpected is intercepting your traffic; stop and investigate.

See what’s happening

LightAtom's connections view shows whether your tools connect to a proxy address instead of the server, and which process runs that proxy.

Frequently asked questions

What does “self signed certificate in certificate chain” mean?

The chain the server presented ends in a self-signed root your tool doesn't trust. On company networks that root usually belongs to an HTTPS-inspecting proxy.

How do I fix it for npm?

Set NODE_EXTRA_CA_CERTS to the proxy's root certificate (PEM), or npm config set cafile to a bundle containing it. Don't disable strict-ssl.

How do I make a trusted local HTTPS certificate?

Use mkcert: it creates a local CA, installs it in the macOS keychain and issues certificates for localhost and your dev domains.

Related errors and tools

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.