Error: SELF_SIGNED_CERT_IN_CHAIN

Self-signed certificate errors in Node.js are nearly always environment-specific: local development works, but CI servers or corporate laptops fail. The most common cause is a TLS-inspecting proxy — tools like ZScaler, BlueCoat, or Cisco Umbrella sit between the Node process and the internet, decrypting HTTPS traffic and re-signing it with their own corporate root certificate. From Node's perspective, every HTTPS connection presents a certificate not in Node's built-in CA bundle (which bundles Mozilla's trusted root list). The correct fix is to add the corporate root certificate to Node's trusted bundle via NODE_EXTRA_CA_CERTS=/path/to/corporate-cert.pem. This tells Node to trust that certificate authority in addition to the built-in ones. The certificate file should be PEM-encoded, obtainable from your IT team or by running openssl s_client -connect registry.npmjs.org:443 -showcerts through the proxy and extracting the intermediate CA certificate from the output. Setting NODE_TLS_REJECT_UNAUTHORIZED=0 is widely suggested online but creates a serious security risk: it disables ALL certificate validation, making the connection vulnerable to real man-in-the-middle attacks. Restrict this to isolated local development containers that never handle sensitive data and never use it in CI or production. On AWS services, the AWS SDK trusts the bundled Mozilla CA set by default, which bypasses corporate proxy certificate issues for AWS API calls.