LightAtom

"Unable to Get Local Issuer Certificate": Fixes for git, curl, npm and Python

A command-line tool couldn't verify a server's certificate because it doesn't trust the issuer, usually a company proxy's certificate or an outdated CA bundle.

unable to get local issuer certificate

The tool couldn't find the certificate authority that signed the server's certificate in its own list of trusted authorities, so it refused the connection.

Quick checks

  • Are you on a company network or VPN that inspects HTTPS? That's the usual cause.
  • Does the same URL work in your browser? Browsers use the macOS keychain; many CLI tools don't.

Fixes on Mac

  1. Get your company's root certificate

    1. Ask IT for the root CA, or export it from Keychain Access (System Roots or System) as a .pem file.

  2. Tell each tool about it

    1. git: git config --global http.sslCAInfo /path/to/company-root.pem.
    2. curl: curl --cacert /path/to/company-root.pem … or set CURL_CA_BUNDLE.
    3. Node.js / npm: export NODE_EXTRA_CA_CERTS=/path/to/company-root.pem, or npm config set cafile /path/to/company-root.pem.
    4. Python / pip: pip config set global.cert /path/to/bundle.pem; python.org installs include Install Certificates.command in the Python folder in Applications, which installs certifi's bundle.

  3. Update CA bundles

    1. Homebrew tools use Homebrew's bundle: brew upgrade ca-certificates.
    2. For Python: pip install --upgrade certifi.

Fixes on Windows

  1. Windows

    1. Git for Windows can use the Windows store: git config --global http.sslBackend schannel.

Other devices

  1. Docker and CI

    1. Copy the root into the image (/usr/local/share/ca-certificates/) and run update-ca-certificates.

Still not working?

Don't fix this with git config http.sslVerify false, npm config set strict-ssl false or NODE_TLS_REJECT_UNAUTHORIZED=0: they turn off the check that protects you from interception. If the server itself is missing its intermediate certificate, browsers may still work (they fetch or cache intermediates) while CLI tools fail; the site's owner should serve the full chain.

See what’s happening

LightAtom's connections view shows whether your tools connect to a proxy address instead of the server, and which process runs that proxy.

Frequently asked questions

Why does it work in the browser but not in git or npm?

Browsers on macOS trust the keychain, where IT installs company roots. git, curl, Node and Python often use their own CA bundles that don't include them.

Is it safe to disable SSL verification?

No. It makes the tool accept any certificate, including an attacker's. Add the correct root certificate instead.

What is NODE_EXTRA_CA_CERTS?

An environment variable pointing Node.js to extra trusted certificates in PEM format, added to Node's built-in list. npm and most Node tools respect it.

Related errors and tools

Related

LightAtom team

The people who build LightAtom, a network monitor for macOS.