Short answer
Get your company’s root certificate as a PEM file from IT, then point Node.js at it with NODE_EXTRA_CA_CERTS=/path/company-ca.pem (npm runs on Node.js, so this covers npm install too). It is read when the process starts, so set it in the shell or CI environment, not inside your script. On Node.js 22.15 or newer, --use-system-ca makes Node.js trust the certificates your operating system already trusts. For your own local HTTPS server, use a locally trusted CA (for example with mkcert) instead of a raw self-signed certificate. Do not set NODE_TLS_REJECT_UNAUTHORIZED=0 or strict-ssl=false.
Why the certificate is not trusted, and the fix
01
A company proxy or security tool re-signs traffic
“When set, the well known "root" CAs (like VeriSign) will be extended with the extra certificates in file.” Node.js, Command-line options: NODE_EXTRA_CA_CERTS
Tools such as Zscaler, Netskope or antivirus HTTPS scanning replace each site’s certificate with one signed by the company’s own root. The operating system trusts that root; Node.js uses its own bundled list and does not. Add the root to Node.js.
# macOS / Linux, in ~/.zshrc or ~/.bashrc export NODE_EXTRA_CA_CERTS="$HOME/certs/company-ca.pem"02
npm install fails the same way
“A path to a file containing one or multiple Certificate Authority signing certificates.” npm Docs, npm config: cafile
NODE_EXTRA_CA_CERTS already covers npm, because npm runs on Node.js. Use npm’s cafile setting only if you must: it replaces npm’s default certificate list instead of adding to it, so the file has to contain the full chain npm needs.
npm config set cafile "$HOME/certs/company-ca.pem"03
Turning verification off
“This makes TLS, and HTTPS by extension, insecure. The use of this environment variable is strongly discouraged.” Node.js, Command-line options: NODE_TLS_REJECT_UNAUTHORIZED
NODE_TLS_REJECT_UNAUTHORIZED=0 and npm strict-ssl=false make the error go away by accepting any certificate, including an attacker’s. Never ship them, and remove them from shell profiles and CI once the real CA is in place.
04
Your own self-signed development certificate
A local API on https://localhost with a self-signed certificate fails the same check. Create the certificate with a local CA that your machine trusts (mkcert does this), then add that CA to NODE_EXTRA_CA_CERTS for Node.js clients. This is for development only; never share the rootCA-key.pem file mkcert creates.
mkcert -install mkcert localhost export NODE_EXTRA_CA_CERTS="$(mkcert -CAROOT)/rootCA.pem"
Checked against the vendor’s docs on : Node.js: Command-line options (NODE_EXTRA_CA_CERTS, --use-system-ca); npm Docs: config (cafile).
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start
Related: npm “EACCES: permission denied” · Node.js ERR_OSSL_EVP_UNSUPPORTED · Node.js “getaddrinfo ENOTFOUND” · Node.js “certificate has expired”