self signed certificate in certificate chain
The chain ends in an untrusted root
Seen in Node.js (SELF_SIGNED_CERT_IN_CHAIN), npm, Git, curl
The chain ends at a root certificate the client does not trust, usually a corporate or private CA.
Common causes
- A TLS-inspecting corporate proxy or antivirus.
- An internal service using a private CA.
- A genuinely self-signed server certificate.
How to fix it
- Add the corporate/private CA to the tool (NODE_EXTRA_CA_CERTS, git config http.sslCAInfo, npm config cafile).
- Use a publicly trusted certificate for public services.
- Don't turn off verification (strict-ssl=false) except for a one-off test.
Got a different message? Paste it into the error explainer.
Related errors
- unable to get local issuer certificate · The client can't find the certificate's issuer
- unable to verify the first certificate · The intermediate certificate is missing
- certificate has expired · The server certificate has expired
- curl: (51) SSL: no alternative certificate subject name matches target host name · The certificate doesn't match the hostname
- curl: (35) SSL connect error · The TLS handshake failed
- sslv3 alert handshake failure · The server rejected the TLS handshake
- tlsv1 alert protocol version · The peer does not accept this TLS version
- tlsv1 alert unknown ca · The peer doesn't trust the certificate's CA
- no peer certificate available · The handshake failed before a certificate arrived
- Unable to establish SSL connection. · wget could not complete the TLS handshake
- ERROR: cannot verify example.com's certificate · wget doesn't trust the server's certificate
- Error [ERR_TLS_CERT_ALTNAME_INVALID]: Hostname/IP does not match certificate's altnames · The certificate doesn't cover this hostname