Self-Signed Certificate in Certificate Chain (npm, Node.js, curl, Python): Fix

It is OpenSSL verification error 19, X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN: «The certificate chain could be built up using the untrusted certificates but no suitable trust anchor (which typically is a self-signed root certificate) could be found in the trust store» (X509_STORE_CTX_get_error). The server sent a complete chain all the way up to a self-signed root, and that root is not one the client trusts.

The spelling depends on the OpenSSL version: OpenSSL 3 prints self-signed certificate in certificate chain, OpenSSL 1.1.1 printed self signed certificate in certificate chain (x509_txt.c). You will see it as:

• npm and Node.js: code SELF_SIGNED_CERT_IN_CHAIN, message self-signed certificate in certificate chain.
• curl: curl: (60) SSL certificate problem: self-signed certificate in certificate chain.
• Python: certificate verify failed: self-signed certificate in certificate chain; see the Python page for its trust store specifics.

Its neighbour is error 18, X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT (DEPTH_ZERO_SELF_SIGNED_CERT in Node.js): there the server's own certificate is self-signed, with no chain at all. OpenSSL picks 18 when the self-signed certificate is the only one, and 19 when it sits at the top of a longer chain (x509_vfy.c).

TLS inspection is the most common case on work laptops. The browser trusts the proxy's root because IT installed it in the operating system, but Node.js ships its own list of roots and many Python installs use certifi, so command-line tools still fail. Whether you see error 19 or error 20 depends on the proxy: if it sends its root inside the chain you get 19; if it sends only the re-signed leaf and an intermediate, you get unable to get local issuer certificate.

openssl s_client -connect registry.npmjs.org:443 -servername registry.npmjs.org -showcerts </dev/null 2>/dev/null | grep -E '^ *[0-9] s:|^ *i:'

The last certificate whose subject (s:) equals its issuer (i:) is the self-signed root. Run the same command from a network without inspection (a phone hotspot): if the issuer changes, a proxy is re-signing traffic. Before you add any root to a trust store, save it and compare its fingerprint with the one your IT or PKI team publishes:

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | awk '/BEGIN CERT/{n++; p=1} p{print > ("chain-" n ".pem")} /END CERT/{p=0}'
ls chain-*.pem
openssl x509 -in chain-3.pem -noout -subject -fingerprint -sha256   # the last file is the top of the chain

Trusting a root means trusting everything it signs, for every host. Do it only for a root you can attribute to someone responsible for it.

1. Operating system (Debian/Ubuntu): cp corp-root.pem /usr/local/share/ca-certificates/corp-root.crt && update-ca-certificates. curl, Git and most system OpenSSL users pick it up.
2. Node.js: export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root.crt before starting the process; the variable is read only at launch (Node.js CLI). On Node 23.8+, --use-system-ca makes Node trust the OS store where IT already installed the root.
3. npm: npm config set cafile /usr/local/share/ca-certificates/corp-root.crt. Leave strict-ssl at its default true.
4. pip: pip install --cert /path/corp-bundle.pem ... or set the cert option in pip's config; the bundle must contain the corporate root.
5. Your own service with a private CA: serve leaf + intermediate (the root itself is optional in the chain) and distribute the root to clients through configuration management, not by disabling checks.
6. Avoid npm config set strict-ssl false, NODE_TLS_REJECT_UNAUTHORIZED=0 and curl -k. They hide this error by accepting any certificate, including an attacker's.

curl -sS -o /dev/null -w '%{http_code}\n' https://registry.npmjs.org/
# 200
node -e "fetch('https://registry.npmjs.org/').then(r => console.log(r.status), e => console.log(e.cause?.code))"
# 200
npm ping

If you run the server, check what the public sees: the SSL/TLS checker builds the chain from outside your network, without any corporate root, and shows whether it ends at a publicly trusted CA.

• unable to get local issuer certificate — error 20, the root is missing from the chain too
• MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT — Firefox, self-signed leaf
• x509: certificate signed by unknown authority — the same problem in Go
• PKIX path building failed — the Java equivalent
• SEC_ERROR_UNKNOWN_ISSUER — Firefox, untrusted issuer
• Self-signed certificates — when they are appropriate