# Node.js "self signed certificate in certificate chain" - Fix TLS in CI

> Fix Node.js / npm "self signed certificate in certificate chain" in CI - caused by a TLS-intercepting proxy. Add the CA, don’t disable NODE_TLS_REJECT_UNAUTHORIZED.

Source: https://latchkey.dev/learn/node-js/node-self-signed-cert-tls-reject  
Updated: 2026-06-25

Node could not validate the TLS chain because it ends in a self-signed certificate it does not trust - almost always a corporate proxy re-signing HTTPS. The fix is to trust the proxy’s CA, not to switch verification off.

## Diagnose it: which registry, and with what credentials?

Registry errors are resolved in a precedence chain, and the effective value is rarely the one in the file you are looking at. Scoped registries, `.npmrc` files at several levels, and environment variables all combine before a request is made.

```Terminal
# the effective, fully merged configuration
npm config list -l | grep -E "registry|_auth|always-auth"

# where each value came from
npm config get registry
npm config get @yourscope:registry

# prove the token works, independently of the install
curl -sI -H "Authorization: Bearer $NPM_TOKEN" \
  "$(npm config get registry)@yourscope%2fpackage" | head -1
```

> A private package 404s rather than 401s when the token lacks read access, because the registry will not confirm that a package you cannot see exists. Treat an unexpected 404 on a private scope as an auth problem, not a missing package.

## FAQ

### What causes Node.js "self signed certificate in certificate chain"?

There are 2 common causes: a tls-intercepting proxy and missing ca bundle on a minimal image. A corporate proxy terminates TLS and re-signs traffic with its own root CA.

### How do I fix Node.js "self signed certificate in certificate chain"?

There are 2 fixes depending on which cause you have: trust the proxy’s ca (correct fix) and never disable verification permanently. Work through them in order, since the first is the most common.

### What does Node.js "self signed certificate in certificate chain" actually mean?

npm install, a fetch, or any HTTPS call fails with self signed certificate in certificate chain (code SELF_SIGNED_CERT_IN_CHAIN).

### How do I stop Node.js "self signed certificate in certificate chain" happening again?

Install the proxy’s root CA into the runner image and use NODE_EXTRA_CA_CERTS. The prevention section lists 3 changes that keep it from recurring.

### Can Latchkey fix this automatically?

Yes. Latchkey runs your GitHub Actions on managed runners that detect this failure, apply the fix, and retry the job automatically - self-healing is on by default.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt