Node.js / npm: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY', 'SELF_SIGNED_CERT_IN_CHAIN' or 'unable to get local issuer certificate' behind a corporate proxy or TLS-inspecting firewall. How do I fix it without disabling TLS checks?

Cause: Node.js verifies HTTPS certificates against its own bundled list of trusted root CAs, not the operating system's store (by default). Corporate proxies and security products that inspect TLS re-sign traffic with a company root CA. Your OS and browser trust that CA, but Node, npm, yarn and tools built on Node (including many AI coding agents and MCP servers) don't, so every HTTPS request fails. It also happens with internal services that use a private CA. Fix (best first): 1. Get the company root CA certificate as a PEM file (ask IT, or export it from the OS trust store). 2. Tell Node to trust it in addition to the bundled CAs: export NODE_EXTRA_CA_CERTS=/path/to/company-ca.pem. Set it in the shell profile, the service's environment, CI variables or the Dockerfile. It must be set before the Node process starts. 3. Or use the operating system's trust store: newer Node.js releases support --use-system-ca (or NODE_OPTIONS=--use-system-ca), which reads the OS certificate store, so certificates IT already deployed just work. Check that your Node version documents this flag. 4. For npm specifically you can also set npm config set cafile /path/to/company-ca.pem. 5. In containers, copy the CA into the image and set NODE_EXTRA_CA_CERTS (and update-ca-certificates for non-Node tools). Don't: set NODE_TLS_REJECT_UNAUTHORIZED=0 or npm config set strict-ssl false. They turn off certificate checking for everything, so any machine in the middle could read or change your traffic, including package downloads and API keys. Node prints a warning for a reason. Verify: node -e "fetch('https://registry.npmjs.org').then(r=>console.log(r.status))" prints 200, and npm ping succeeds, with TLS checking still on. Sources: https://nodejs.org/api/cli.html https://docs.npmjs.com/cli/v10/using-npm/config