Receiving Error: 'Error: Ssl Error: Self_Signed_Cert_In_Chain' While Using Npm

Question

I am using npm v1.0.104/node 0.6.12 on ubuntu - I am receiving the error copied below while attempting to install any new modules via npm (I tested socket.io earlier using http, not https though & am wondering if that could have resulted in the issue with npm/unsigned certs). The error pops up once npm tries to resolve the '' URL. Is there anyway I can ignore the error or perhaps locate/add the cert to a trusted store in order to continue using npm.

Any insight on what needs to be done to resolve the issue will be appreciated (I would prefer to resolve the issue through configuration as opposed to re-installing if possible).

Error: "Error: SSL Error: SELF_SIGNED_CERT_IN_CHAIN"

Full Message:

npm ERR! Error: SSL Error: SELF_SIGNED_CERT_IN_CHAIN
npm ERR!     at ClientRequest.<anonymous> (/usr/lib/node_modules/npm/node_modules/request/main.js:252:28)
npm ERR!     at ClientRequest.emit (events.js:67:17)
npm ERR!     at HTTPParser.onIncoming (http.js:1261:11)
npm ERR!     at HTTPParser.onHeadersComplete (http.js:102:31)
npm ERR!     at CleartextStream.ondata (http.js:1150:24)
npm ERR!     at CleartextStream._push (tls.js:375:27)
npm ERR!     at SecurePair.cycle (tls.js:734:20)
npm ERR!     at EncryptedStream.write (tls.js:130:13)
npm ERR!     at Socket.ondata (stream.js:38:26)
npm ERR!     at Socket.emit (events.js:67:17)
npm ERR! Report this *entire* log at:
npm ERR!     <
npm ERR! or email it to:
npm ERR!     <>
npm ERR! 
npm ERR! System Linux 2.6.38-13-generic
npm ERR! command "node" "/usr/bin/npm" "install" "jed"
npm ERR! node -v v0.6.12
npm ERR! npm -v 1.0.104

Accepted Answer

Running the following helped resolve the issue:

npm config set strict-ssl false

I cannot comment on whether it will cause any other issues at this point in time.

Answer 2

As of February 27, 2014, npm no longer supports its self-signed certificates. The following options, as recommended by npm, is to do one of the following:

Upgrade your version of npm

npm install npm -g --ca=""

-- OR --

Tell your current version of npm to use known registrars

npm config set ca ""

Update: npm has posted More help with SELF_SIGNED_CERT_IN_CHAIN and npm with more solutions particular to different environments

You may or may not need to prepend sudo to the recommendations.

Other options

It seems that people are having issues using npm's recommendations, so here are some other potential solutions.

Upgrade Node itself
Receiving this error may suggest you have an older version of node, which naturally comes with an older version of npm. One solution is to upgrade your version of Node. This is likely the best option as it brings you up to date and fixes existing bugs and vulnerabilities.

The process here depends on how you've installed Node, your operating system, and otherwise.

Update npm
Being that you probably got here while trying to install a package, it is possible that npm install npm -g might fail with the same error. If this is the case, use update instead. As suggested by Nisanth Sojan:

npm update npm -g

Update npm alternative
One way around the underlying issue is to use known registrars, install, and then stop using known registrars. As suggested by jnylen:

npm config set ca ""
npm install npm -g
npm config delete ca

Answer 3

For now I just switched registry URL from https to http. Like this:

npm config set registry=""

Answer 4

npm config set strict-ssl false -g

To save it globally

Answer 5

The error SELF_SIGNED_CERT_IN_CHAIN means that you have self signed certificate in certificate chain which is basically not trusted by the system.

If that happens, basically something fishy is going on, therefore as people already commented, it is not recommended to just disable certificate checks, but better approach is to understand what is the problem and fix the cause of it.

This maybe related either to:

custom repository address which doesn't have the right certificate,
a corporate network with transparent proxy.

If you're behind a corporate web proxy, you should set-up the proper HTTP_PROXY/HTTPS_PROXY environment variables or set them via npm:
```
  npm config set proxy 
  npm config set https-proxy 
```
See: How to setup Node.js and Npm behind a corporate web proxy

If you trust the host, you can export the self-signed certificate from the chain and import them into system, so they're marked as trusted.

This can be achieved by checking the certificates by (change example.com into npm repo which is failing based on the npm-debug.log):

openssl s_client -showcerts -connect example.com:443 < /dev/null

then save the certificate content (between BEGIN and END) into .crt file in order to import it.

Must Read

Linux

As per suggestion, you can add the below to the /etc/environment file (Node 7.4+) to export your CA chain, like:

NODE_EXTRA_CA_CERTS=/etc/pki/ca-trust/source/anchors/yourCer‌ts.pem

CentOS

On CentOS 5 this can be appended into /etc/pki/tls/certs/ca-bundle.crt file, e.g.

ex +'g/BEGIN CERTIFICATE/,/END CERTIFICATE/p' <(echo | openssl s_client -showcerts -connect example.com:443) -scq | sudo tee -a /etc/pki/tls/certs/ca-bundle.crt
sudo update-ca-trust force-enable
sudo update-ca-trust extract
npm install

^{Note: To export only first certificate, remove g at the beginning.}

In CentOS 6, the certificate file can be copied to /etc/pki/ca-trust/source/anchors/.

Ubuntu/Debian

In Ubuntu/Debian, copy CRT file into /usr/local/share/ca-certificates/ then run:

sudo update-ca-certificates