npm install error - unable to get local issuer certificate

Question

I am getting an unable to get local issuer certificate error when performing an npm install:

typings ERR! message Unable to read typings for "es6-shim". You should check the
 entry paths in "es6-shim.d.ts" are up to date
typings ERR! caused by Unable to connect to "https://raw.githubusercontent.com/D
efinitelyTyped/DefinitelyTyped/7de6c3dd94feaeb21f20054b9f30d5dabc5efabd/es6-shim
/es6-shim.d.ts"
typings ERR! caused by unable to get local issuer certificate

I have recently update to node 4 from a much earlier version and it sounds like node is much more strict when these kind of problems arise.

There is an issue discussed here which talks about using ca files, but it's a bit beyond my understanding and I'm unsure what to do about it.

I am behind a corporate firewall, but I can get to the url fine in a browser without any restriction.

Does anyone have any further insight into this issue and what possible solutions there are?

I'm wondering about reverting to node 0.12 in the meantime :(

Equilibrant

Using the following tool github.com/PeterHdd/pcer, would solve this problem – – Nb

Answer 1

Typings can be configured with the ~/.typingsrc config file. (~ means your home directory)

After finding this issue on github: https://github.com/typings/typings/issues/120, I was able to hack around this issue by creating ~/.typingsrc and setting this configuration:

{
  "proxy": "http://<server>:<port>",
  "rejectUnauthorized": false
}

It also seemed to work without the proxy setting, so maybe it was able to pick that up from the environment somewhere.

This is not a true solution, but was enough for typings to ignore the corporate firewall issues so that I could continue working. I'm sure there is a better solution out there.

Yaws

Answer 2

Try

npm config set strict-ssl false

This is a alternative shared in this url https://github.com/nodejs/node/issues/3742

Girosol

Is it safe to restrict strict-ssl? – Ruhl

Is it safe? Short answer: No. Long answer, yes, but only if you are on a secure network with a proxy server that does the SSL validation for you. Speak to your network administrator. – Sharpfreeze

I had this problem, and this answer did not help me, nor did nfiles answer help... – Sachasachem

Interesting how this might help for some users but after using npm install, revert the process to true. – Inclusion

If you're using yarn: yarn config set "strict-ssl" false – Hekker

Or, if you can, get off your VPN when you run npm i, and keep the strict-ssl=true... In my particular case, the install couldn't finish without errors regardless of the strict-ssl parameter, as long as I was on the VPN. Off the VPN it worked fine regardless of the parameter. – Dollarbird

Answer 3

This worked for me:

export NODE_TLS_REJECT_UNAUTHORIZED=0

Please refer to the NodeJS documentation for usage and warnings: https://nodejs.org/api/cli.html#cli_node_tls_reject_unauthorized_value

Hod

This answer would be better with some explanation or documentation reference. – Consociate

I'm still getting this warning message. (node:47985) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification. npm ERR! prepareGitDep Error making request. npm ERR! prepareGitDep Error: SSL Error: UNABLE_TO_GET_ISSUER_CERT_LOCALLY – Flori

What helped me is this https://mcmap.net/q/144925/-npm-throws-error-unable_to_get_issuer_cert_locally-while-installing-any-package-behind-corporate-firewall – Flori

Answer 4

There is an issue discussed here which talks about using ca files, but it's a bit beyond my understanding and I'm unsure what to do about it.

This isn't too difficult once you know how! For Windows:

Using Chrome go to the root URL NPM is complaining about (so https://raw.githubusercontent.com in your case). Open up dev tools and go to Security-> View Certificate. Check Certification path and make sure your at the top level certificate, if not open that one. Now go to "Details" and export the cert with "Copy to File...".

You need to convert this from DER to PEM. There are several ways to do this, but the easiest way I found was an online tool which should be easy to find with relevant keywords.

Now if you open the key with your favorite text editor you should see

-----BEGIN CERTIFICATE----- 

yourkey

-----END CERTIFICATE-----

This is the format you need. You can do this for as many keys as you need, and combine them all into one file. I had to do github and the npm registry keys in my case.

Now just edit your .npmrc to point to the file containing your keys like so

cafile=C:\workspace\rootCerts.crt

I have personally found this to perform significantly better behind our corporate proxy as opposed to the strict-ssl option. YMMV.

Ringmaster

Best answer IMO as it works(for me) and it doesn't involve bypassing security checks – Benzol

Stupid question, is it safe to use an online tool to convert my cert? – Daliadalila

@Neil, Yes it's safe because the certificate contains the public key. It doesn't contain the private key that must be kept secret. – Dogberry

A wellsuited answer if you are behind corporate proxy – Aviculture

In windows, you can directly export the file as a PEM -- Just select the "Base64 Encoded X.509" version instead of the DER version. Also, the certificate doesn't contain yourkey. Instead it contains an X.509 formatted certificate. – Pressure

Seems to work on OSX as well! – Reek

Awesome, after so many attempts for my work computer... Finally something that works – Angell

If you're using brew on a recent OSX, the cafile is in your brew cellar, e.g. $HOME/homebrew/Cellar/ca-certificates/2022-07-19_1/share/ca-certificates/cacert.pem – Lyra

I had to use certfile=C:\Users\myUserName\rootCer.crt. cafile did not work for me. – Siderosis

I was struggling a lot but your description was for me that solved the problem of "unable to get local issuer certificate" Thanks Tim L. – Volcanism

I am also behind corporate proxy, but this didn't work for me. Can someone please help – Extender

Answer 5

Anyone gets this error when 'npm install' is trying to fetch a package from HTTPS server with a self-signed or invalid certificate.

Quick and insecure solution:

npm config set strict-ssl false

Why this solution is insecure? The above command tells npm to connect and fetch module from server even server do not have valid certificate and server identity is not verified. So if there is a proxy server between npm client and actual server, it provided man in middle attack opportunity to an intruder.

Secure solution:

If any module in your package.json is hosted on a server with self-signed CA certificate then npm is unable to identify that server with an available system CA certificates. So you need to provide CA certificate for server validation with the explicit configuration in .npmrc. In .npmrc you need to provide cafile, please refer to more detail about cafile configuration.

cafile=./ca-certs.pem

In ca-certs file, you can add any number of CA certificates(public) that you required to identify servers. The certificate should be in “Base-64 encoded X.509 (.CER)(PEM)” format.

For example,

# cat ca-certs.pem 
DigiCert Global Root CA
=======================
-----BEGIN CERTIFICATE-----
CAUw7C29C79Fv1C5qfPrmAE.....
-----END CERTIFICATE-----

VeriSign Class 3 Public Primary Certification Authority - G5
========================================
-----BEGIN CERTIFICATE-----
MIIE0zCCA7ugAwIBAgIQ......
-----END CERTIFICATE-----

Note: once you provide cafile configuration in .npmrc, npm try to identify all server using CA certificate(s) provided in cafile only, it won't check system CA certificate bundles then. Here's a well-known public CA authority certificate bundle.

One other situation when you get this error:

If you have mentioned Git URL as a dependency in package.json and git is on invalid/self-signed certificate then also npm throws a similar error. You can fix it with following configuration for git client

git config --global http.sslVerify false 

Monopoly

If the system is behind the secure proxy of company/organization, this kind of error occurs. And for that secure solution should always be preferred. Just to add more to this answers. Following commands can be used to set cafile=./ca-certs.pem in npmrc file. To set the cafile: npm config set cafile <CERT_FILE_PATH> To verify the set cafile: npm config get cafile For more information on how to set config please visit, docs.npmjs.com/misc/config#cafile and docs.npmjs.com/cli/config#set – Benjy

When your internet access via secure proxy, npm client gets certificate of site from proxy, In this case if your host OS trust the proxy certificate then its not a issue, other wise you need to configure proxy CA certificate for trust. – Monopoly

Answer 6

If you're on a corporate computer, it likely has custom certificates (note the plural on that). It took a while to figure out, but I've been using this little script to grab everything and configure Node, NPM, Yarn, AWS, and Git (turns out the solution is similar for most tools). Stuff this in your ~/.bashrc or ~/.zshrc or similar location:

function setup-certs() {
  # place to put the combined certs
  local cert_path="$HOME/.certs/all.pem"
  local cert_dir=$(dirname "${cert_path}")
  [[ -d "${cert_dir}" ]] || mkdir -p "${cert_dir}"
  # grab all the certs
  security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain > "${cert_path}"
  security find-certificate -a -p /Library/Keychains/System.keychain >> "${cert_path}"
  # configure env vars for commonly used tools
  export GIT_SSL_CAINFO="${cert_path}"
  export AWS_CA_BUNDLE="${cert_path}"
  export NODE_EXTRA_CA_CERTS="${cert_path}"
  # add the certs for npm and yarn
  # and since we have certs, strict-ssl can be true
  npm config set -g cafile "${cert_path}"
  npm config set -g strict-ssl true
  yarn config set cafile "${cert_path}" -g
  yarn config set strict-ssl true -g
}
setup-certs

You can then, at any time, run setup-certs in your terminal. Note that if you're using Nvm to manage Node versions, you'll need to run this for each version of Node. I've noticed that some corporate certificates get rotated every so often. Simply re-running setup-certs fixes all that.

You'll notice that most answers suggest setting strict-ssl to false. Please don't do that. Instead use the setup-certs solution to use the actual certificates.

Mineralogist

Out of all the solutions I have tried, this worked for me right away. Thanks @Mineralogist – Indemonstrable

Answer 7

My problem was that my company proxy was getting in the way. The solution here was to identify the Root CA / certificate chain of our proxy, (on mac) export it from the keychain in .pem format, then export a variable for node to use.

export NODE_EXTRA_CA_CERTS=/path/to/your/CA/cert.pem

Platto

Answer 8

For anyone coming to this from macOS:

Somehow, npm hasn't picked up correct certificates file location, and I needed to explicitly point to it:

$ echo "cafile=$(brew --prefix)/share/ca-certificates/cacert.pem" >> ~/.npmrc
$ cat ~/.npmrc # for ARM macOS
cafile=/opt/homebrew/share/ca-certificates/cacert.pem

Barony

This is the correct answer for those on macOS with node installed via brew. Not sure if it's a ARM-specific issue (hinted at in this answer), but I was on that platform when I encountered the issue. – Batting

This did not work for me on intel macbook, but I did a similar thing with export NODE_EXTRA_CA_CERTS="/path/to/ca-certificates/cacert.pem" in my ~/.zshrc. – Aloud

Answer 9

There are different reason for this issue and workaround is different depends on situation. Listing here few workaround (note: it is insecure workaround so please check your organizational policies before trying).

Step 1: Test and ensure internet is working on machine with command prompt and same url is accessible directly which fails by NPM. There are many tools for this, like curl, wget etc. If you are using windows then try telnet or curl for windows.

Step 2: Set strict ssl to false by using below command

npm -g config set strict-ssl false

Step 3: Set reject unauthorized TLS to no by using below command:

export NODE_TLS_REJECT_UNAUTHORIZED=0

In case of windows (or can use screen to set environment variable):

set NODE_TLS_REJECT_UNAUTHORIZED=0

Step 4: Add unsafe param in installation command e.g.

npm i -g [email protected] --unsafe-perm true

Pappy

Answer 10

Once you have your certificate (cer or pem file), add it as a system variable like in the screenshot below.

This is the secure way of solving the problem, rather than disabling SSL. You have to tell npm or whatever node tool you're using to use these certificates when establing an SSL connection using the environment variable NODE_EXTRA_CA_CERTS.

This is common when you're behind a corporate firewall or proxy. You can find the correct certificate by just inspecting the security tab in Chrome when visiting a page while on your company's VPN or proxy and exporting the certificate through the "Manage Computer Certificates" window in Windows.

Beige

Answer 11

Add:

process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;

Source: Ignore invalid self-signed ssl certificate in node.js with https.request?

Sidoney

managed to bypass my npx command error with this, thank you: NODE_TLS_REJECT_UNAUTHORIZED=0 npx @api-platform/client-generator https://localhost src/ -g react – Irrelevant

In PowerShell, use $env:NODE_TLS_REJECT_UNAUTHORIZED = 0 – Dejected

Answer 12

I have encountered the same issue. This command didn't work for me either:

npm config set strict-ssl false

After digging deeper, I found out that this link was block by our IT admin.

http://registry.npmjs.org/npm

So if you are facing the same issue, make sure this link is accessible to your browser first.

Iinden

The above link is accessible and I have also used the set strict-ssl false command but it is not working still – Hypsometer

ZScaler was blocking us. Thank you! – Induction

Answer 13

In case you use yarn:

yarn config set strict-ssl false

Vinosity

Answer 14

There is another option I would recommend to check before disabling SSL/TLS security or switching to a http:// url:

npm allows to configure a file which contains all trusted root CA certificates. If this file is present and does not contain the necessary root AC certificates this can also end up in a unable to get local issuer certificate error.

Therefore you should check if the command

npm config get cafile

returns a configured file. By default it should return null (no special CA certificate configured). If it returns something different examine the mentioned file and if you want to remove the setting you can open the npm configuration file and remove the cafile entry:

npm config edit

Postilion

Answer 15

A disclaimer: This solution is less secure, bad practice, don't do this. I had a duplicate error message--I'm behind a corporate VPN/firewall. I was able to resolve this issue by adding a .typingsrc file to my user directory (C:\Users\MyUserName\.typingsrc in windows). Of course, anytime you're circumventing SSL you should be yapping to your sys admins to fix the certificate issue.

Change the registry URL from https to http, and as seen in nfiles' answser above, set rejectUnauthorized to false.

.typingsrc (placed in project directory or in user root directory)

{
     "rejectUnauthorized": false,
     "registryURL": "http://api.typings.org/"
}

Optionally add your github token (I didn't find success until I had added this too.)

{
    "rejectUnauthorized": false,
    "registryURL": "http://api.typings.org/",
    "githubToken": "YourGitHubToken"
}

See instructions for setting up your github token at https://github.com/blog/1509-personal-api-tokens

Cubital

Answer 16

Well this is not a right answer but can be consider as a quick workaround. Right answer is turn off Strict SSL.

I am having the same error

PhantomJS not found on PATH
Downloading https://github.com/Medium/phantomjs/releases/download/v2.1.1/phantomjs-2.1.1-windows.zip
Saving to C:\Users\Sam\AppData\Local\Temp\phantomjs\phantomjs-2.1.1-windows.zip
Receiving...

Error making request.
Error: unable to get local issuer certificate
at TLSSocket. (_tls_wrap.js:1105:38)
at emitNone (events.js:106:13)
at TLSSocket.emit (events.js:208:7)
at TLSSocket._finishInit (_tls_wrap.js:639:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:469:38)

So the after reading the error.

Just downloaded the file manually and placed it on the required path. i.e

C:\Users\Sam\AppData\Local\Temp\phantomjs\

This solved my problem.

    PhantomJS not found on PATH                                                                                                
Download already available at C:\Users\sam\AppData\Local\Temp\phantomjs\phantomjs-2.1.1-windows.zip                    
Verified checksum of previously downloaded file                                                                            
Extracting zip contents                                    

Heather

Worked for me, not sure why nothing else was. I'm still only getting set up so I'll try a more permanent solution after I'm up and running. Good idea, thanks! – Devonian

Answer 17

reinstall ca-certificates is work for me

# OSX
brew install ca-certificates

Mulvey

Answer 18

npm config set strict-ssl false

and then install angular again 

npm install -g @angular/cli

once angular is installed then set 

npm config set strict-ssl true

this is safe

Ratiocinate

Answer 19

On FreeBSD, this error can be produced because the cafile path is set to a symlink instead of the absolute path.

Berkshire

Answer 20

On macOs I faced the same problem and in my case my node-gyp just didn't see my .pem file.

Next helped me:

sudo npm install -g node-gyp

node-gyp configure

rm -rf ~/.node-gyp ~/.npm ~/.config

node-gyp configure --cafile="/path/to/myCertificate.pem"

Eason

Answer 21

Sometimes it's the little things. My npm process is owned by root, so I tried the following:

sudo npm install stuff

I forgot that root doesn't have my user's npm configuration, so I needed to add the -E flag to allow root to use my configuration:

sudo -E npm install stuff

Fuqua

this has nothing to do with privileges, but with the server's certificate from the client point of view – Prole

Answer 22

I tried almost all above steps. Somehow none of them worked for me. I added environment variable and restarted powershell it worked.

Spagyric