npm · npm
The message
npm ERR! request to https://registry.npmjs.org/express failed, reason: unable to verify the first certificate
What it means
The TLS connection failed: the certificate chain the server presented leads up to an authority node does not trust. Overwhelmingly this is a corporate network whose proxy opens traffic and re-signs it with its own certificate; occasionally it is a server that failed to send its intermediate certificate. Teaching npm your company's root with npm config set cafile is the correct fix. strict-ssl false also makes this line disappear, but it turns certificate checking off altogether, which lets anyone on the path serve you altered packages — do not use it.
The fix
npm config set cafile /etc/ssl/corp-ca.pem- Printed by
- npm
- npm
- 20
With npm the cause sits in the first code XXXX line rather than the last six npm ERR! lines, and when the failure comes from the dependency tree or a native build instead of your own code, deleting node_modules and installing again clears about half of them.
Reading an error message
- Read from the first line down. The lower you go the more it is about the tool’s internals; the cause is usually at the top.
- If there is a file and a line number, start there — not the top stack frame, but the topmost line that names a file you wrote.
- Search the message verbatim, but strip your own paths and variable names first; those are what stop the search from matching.
- The same condition is worded differently across tool versions. If results look wrong, add the version number to the query.
- Before pasting a fix, check what it throws away. Some of these cannot be undone.
Common questions
Q. What does “npm ERR! request to https://registry.npmjs.org/express failed, reason: unable to verify the first certificate” mean?
The TLS connection failed: the certificate chain the server presented leads up to an authority node does not trust. Overwhelmingly this is a corporate network whose proxy opens traffic and re-signs it with its own certificate; occasionally it is a server that failed to send its intermediate certificate. Teaching npm your company's root with npm config set cafile is the correct fix. strict-ssl false also makes this line disappear, but it turns certificate checking off altogether, which lets anyone on the path serve you altered packages — do not use it.
Q. How do I fix it?
npm config set cafile /etc/ssl/corp-ca.pem — before running it, check the explanation above for what this command discards.
Q. Which tool prints this?
npm. It sits under npm, and the message runs to 13 words.