error unable to get local issuer certificate #841

kevincaradant · 2016-10-12T08:51:12Z

Hi

Do you want to request a feature or report a bug?
Bug

If the current behavior is a bug, please provide the steps to reproduce.

λ yarn config set strict-ssl false
yarn config v0.15.1
success Set "strict-ssl" to "false".
Done in 0.06s.

yarn install

error unable to get local issuer certificate
    at Error (native)
    at TLSSocket.<anonymous> (_tls_wrap.js:1060:38)
    at emitNone (events.js:86:13)
    at TLSSocket.emit (events.js:185:7)
    at TLSSocket._finishInit (_tls_wrap.js:584:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:416:38)
info Visit http://yarnpkg.com/en/docs/cli/install for documentation about this command.

What is the expected behavior?
I want to install my dependencies.
Am I missing something (maybe) ?
Thanks

Please mention your node.js, yarn and operating system version.

NodeJS: V6.7
yarn: v0.15.1
OS: Windows 7

The text was updated successfully, but these errors were encountered:

hallatore · 2016-10-12T09:33:37Z

I have the same issue because we are behind a proxy that adds self-signed ssl.

vbfox · 2016-10-12T09:38:58Z

The same issue happens when strict-ssl is enabled but CAs are manually specified in .npmrc. Yarn seem to ignore all SSL configuration (Or required a different one but I couldn't find it in config)

ca[]="-----BEGIN CERTIFICATE-----\n..."

aurokin · 2016-10-12T15:43:40Z

Having the same issue here at work!

YosefLm · 2016-10-13T03:32:05Z

having the same issue, (i am using self-certificate.)

zwik · 2016-10-13T06:07:38Z

Same issue, also setting the registry to a non-ssl variant or the original non-ssl registry.npmjs.org doesn't help.

chronicIntrovert · 2016-10-13T06:47:07Z

Behind a corporate proxy so running into this issue as well.

roby2001 · 2016-10-13T10:12:00Z

I'm having the same exact error behind a corporate proxy :) . Can't wait for a fix :)

stonefishy · 2016-10-14T11:28:09Z

I have same issue, the network is behind proxy, set strict-ssl to false and also config registry as non-ssl, still not work. Better to fix it as soon as possible. Can't wait it.

mikebranski · 2016-10-14T15:50:39Z

I believe @TAGraves is working on this in #1025. I really want to see it land! 👍

chlunde · 2016-10-14T20:40:42Z

PR #736 will add support for cafile, which is another way to solve this issue, and unlike disabling strict-ssl, you will not be vulnerable to MITM attacks.

sebmck · 2016-10-15T18:18:01Z

We've merged support for cafile and strict-ssl so this issue should be resolved.

elliotwesoff · 2017-03-03T15:15:41Z

I'm still having this issue with yarn v0.21.3

Update: Also on nightly build 0.22.0-20170303.1013

jeffbski · 2017-04-07T17:09:49Z

I found that if I duplicated the strict-ssl and other config from .npmrc into .yarnrc then things started working (or use yarn config set to add each part). I'm not sure why it didn't pick it up from .npmrc.

sylvesteraswin · 2017-04-17T09:18:58Z

I had the same issue under the same circumstances but I ran this command yarn config set strict-ssl false and it worked.

jeffbski · 2017-04-17T15:49:09Z

Yes, that's what worked for me as well.

darul75 · 2017-04-21T15:05:02Z

@sylvesteraswin did the same and it worked, thx 👍

damiandennis · 2017-05-02T06:03:50Z

all broken in 0.23.1, setting registry to http and strict-ssl to false worked but now it does not. I have issues also with the certificate being intercepted and is why I need http.

JesterXL · 2017-07-05T16:39:50Z

I tried yarn config set strict-ssl false, but now am getting "404 Not Found". Mac Sierra, Node 8.1.2, yarn 0.27.5.

UdaySravanK · 2017-07-20T18:43:33Z

@JesterXL It worked for me. Using same version v0.27.5

ao · 2017-08-08T14:28:38Z

yarn config set strict-ssl false worked for me!

afrazahmad21 · 2017-08-17T07:46:45Z

npm config set strict-ssl

worked for me

BYK · 2017-08-18T10:29:25Z

Just making sure people don't blindly copy paste code here: DO NOT DISABLE STRICT SSL CHECKS.

Okay now that I have your attention, if you know what exactly you are doing and what risks you are taking on with this, you may. Otherwise, just don't.

snood1205 · 2017-09-27T18:29:04Z

Is there a solution that doesn't involve exposing yourself to the dangers of using HTTP? I'd really like to be able to fix this without having to disable strict SSL.

Veske · 2018-02-06T11:01:52Z

@ao Enjoy your non deterministic downloads!

shabeermothi · 2018-02-18T02:32:12Z

yarn config set strict-ssl false worked for me. Thanks @sylvesteraswin

Veske · 2019-02-05T09:09:08Z

@vrajpoot That is great! But please do not post it here as it might trick other incautious people to also turn off basic security and potentially download malware on their computers.

It it completely fine to like malware and on purpose infect your computer with it.... but it should stay as a research topic or a hobby thing not an actual thing that one would do on their work machine.

Kielan · 2019-03-04T20:38:29Z

@brandonsturgeon has brought up very valid points that should be addressed and the maintainers of yarn should respond. He's not the only one wondering.

#6578

beejei · 2019-11-18T21:46:23Z

Interesting, everyone saying "do not disable strict-ssl".
But no one ever succeeds.

devashu9 · 2019-11-24T13:13:44Z

yarn config set strict-ssl false worked for me. Thanks

sandipt27 · 2019-11-27T10:56:16Z

I got this error when I tried to install jquery package. Upon tons of re-search finally found that Neither should one set the strict-ssl to false nor should edit the .yarnrc file. Clean and ideal approach for this is -
$ yarn config set cafile "/physical/path/to/certificate-file.pem" and that's it. I was successfully able to install jquery without turning off SSL after firing this command.

One can always check the configuration with yarn before and after above command yarn config list and ensure if the change we made above has taken place or not, which generally it does. :)

FranklinYu · 2019-11-27T21:47:14Z

@sandipt27 I'm sorry that it took you so long to find the right way. You didn't find them probably because:

The yarnrc documentation didn't mention this secret configuration parameter at all. The convention of "undocumented feature is experimental" doesn't seem to hold for Yarn.
Even the NPM documentation is too brief to be useful. For example, it didn't specify what kind of expansion is done, which is probably platform dependent. Again, people have been using undocumented features for long.
Actually cafile has been mentioned several times in this issue, but more people are simply spamming "hey disable SSL works for me" without thinking about security because they want their job quickly done. Who needs SSL anyway?

You probably can't fix 3, and 2 is in another scope, but maybe someone can come out and fix 1. If you come up with a Pull Request and want a second pair of eye I can probably help (I do have some general knowledge about cryptography), although I'm not able to approve it since I'm not a maintainer.

beejei · 2019-12-10T10:20:10Z

#841 (comment)
It doesn't work for me.

I set up a private repository(Verdaccio) with local issuer certificate
And made the same setting with a chained certificate file.
But Yarn has failed to download the packages.

It worked in NPM without any issue.

sandipt27 · 2019-12-18T11:58:48Z

@sandipt27 I'm sorry that it took you so long to find the right way. You didn't find them probably because:

The yarnrc documentation didn't mention this secret configuration parameter at all. The convention of "undocumented feature is experimental" doesn't seem to hold for Yarn.

Even the NPM documentation is too brief to be useful. For example, it didn't specify what kind of expansion is done, which is probably platform dependent. Again, people have been using undocumented features for long.

Actually cafile has been mentioned several times in this issue, but more people are simply spamming "hey disable SSL works for me" without thinking about security because they want their job quickly done. Who needs SSL anyway?

You probably can't fix 3, and 2 is in another scope, but maybe someone can come out and fix 1. If you come up with a Pull Request and want a second pair of eye I can probably help (I do have some general knowledge about cryptography), although I'm not able to approve it since I'm not a maintainer.

Will surely let you know for your needed help once I move towards Pull Request to fix it. :)

michaeloryl · 2020-01-16T12:52:40Z

I'm seeing the same thing as well sitting behind a Nexus proxy group. The CA file setting is set with both NPM and Yarn at this point, but I still get the error.

➜ yarn config list
yarn config v1.21.1
info yarn config
{
  'version-tag-prefix': 'v',
  'version-git-tag': true,
  'version-commit-hooks': true,
  'version-git-sign': false,
  'version-git-message': 'v%s',
  'init-version': '1.0.0',
  'init-license': 'MIT',
  'save-prefix': '^',
  'bin-links': true,
  'ignore-scripts': false,
  'ignore-optional': false,
  registry: 'https://registry.yarnpkg.com',
  'strict-ssl': true,
  'user-agent': 'yarn/1.21.1 npm/? node/v12.14.1 darwin x64',
  cafile: '/Users/XXXXXXX/pml_root_ca.pem',
  email: 'XXXXXXXXXXXXXXX',
  username: 'XXXXXXX'
}
info npm config
{
  '//registry.npmjs.org/:_authToken': XXXXXXXXXXXXXXXXXXXXX',
  cafile: '/Users/XXXXXXX/pml_root_ca.pem',
  registry: 'https://XXXXXXXXXXXXXXXXX/repository/npmjs/',
  '//nexus.pennmutual.com/repository/pml-npmjs/:_authToken': 'XXXXXXXXXXXXXXXXX',
  python: '/usr/bin/python'
}
✨  Done in 0.04s.

cdir-ui on  feature/build_api is 📦 v0.1.0 via ⬢ v12.14.1 
➜ yarn install
yarn install v1.21.1
[1/5] 🔍  Validating package.json...
[2/5] 🔍  Resolving packages...
[3/5] 🚚  Fetching packages...
error An unexpected error occurred: "https://registry.yarnpkg.com/dotenv/-/dotenv-8.2.0.tgz: unable to get local issuer certificate".
info If you think this is a bug, please open a bug report with the information provided in "/Users/XXXXXXX/Projects/cdir-ui/yarn-error.log
cdir-ui on  feature/build_api is 📦 v0.1.0 via ⬢ v12.14.1

cben · 2020-06-08T10:31:28Z

IIUC, once you set ca or cafile in any way, yarn provides a TLS config to Node, replacing any trust Node would set itself.
Instead, to be able to use both system's CA trust store (#6578) AND an extra CA, make sure yarn config list shows no ca / cafile configured, and try setting these env vars:

# Depends how Node was compiled, already default on many Linuxes but can't hurt:
export NODE_OPTIONS=--use-openssl-ca

export NODE_EXTRA_CA_CERTS=/path/to/file.crt

wald-tq · 2021-03-19T12:28:49Z

This issue ranks pretty high in Google search. The amount of comments that tell you to disable SSL certificate verification is disturbing. Can we please make the web a safer place and cleanup the comments?
We can leave one comment mentioning to disable SSL verification along with a reasonable warning.

The NODE_EXTRA_CA_CERTS as mentioned by @cben works for me and is IMHO the cleanest setting.

adjenks · 2021-06-17T18:24:37Z

NODE_EXTRA_CA_CERTS seems to work if you provide the whole chain as a CA. Is there a way to set the verification depth of the chain? If I provide a root CA and there is an intermediate, it does not work. It seems to only validate what's immediately in the CA store and will not walk up the chain to validate.

wald-tq · 2021-07-05T15:04:34Z

@adjenks thats the idea of a certificate chain. If you don't provide the whole chain, you can't verify the correctness.

adjenks · 2021-07-06T18:34:26Z

Ah okay, thank you @wald-tq . Some clients, Chrome for example, will use the Authority Information Access (AIA) certificate extension, which contains information about how to get the issuer of this certificate, to fetch the certificate of the issuer automatically. I suppose it doesn't get used here.

stephenpatten · 2021-07-13T14:28:33Z

Hello @BYK @cben @wald-tq ,

I hate to pile onto a thread this deep, please accept my apology. Given this docker file which is a modified "Getting Started Walkthrough" from docker desktop:

FROM node:12-alpine
RUN apk update && apk add --no-cache python g++ make && rm -rf /var/cache/apk/*
COPY ./zscalerrootca.crt /usr/local/share/ca-certificates/zscalerrootca.crt
WORKDIR /app
COPY . .
RUN export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/zscalerrootca.crt
RUN yarn install --production --verbose
CMD ["node", "src/index.js"]

Results:

[7/7] RUN yarn install --production --verbose:
#12 0.500 yarn install v1.22.5
#12 0.515 verbose 0.1059254 Checking for configuration file "/app/.npmrc".
#12 0.516 verbose 0.1063001 Checking for configuration file "/usr/local/share/.npmrc".
#12 0.516 verbose 0.1066349 Checking for configuration file "/usr/local/etc/npmrc".
#12 0.516 verbose 0.107022 Checking for configuration file "/root/.npmrc".
#12 0.517 verbose 0.1073464 Checking for configuration file "/app/.npmrc".
#12 0.518 verbose 0.1083168 Checking for configuration file "/app/.yarnrc".
#12 0.518 verbose 0.1086306 Checking for configuration file "/usr/local/share/.yarnrc".
#12 0.518 verbose 0.1088907 Checking for configuration file "/usr/local/etc/yarnrc".
#12 0.519 verbose 0.1093044 Checking for configuration file "/root/.yarnrc".
#12 0.519 verbose 0.1095451 Checking for configuration file "/app/.yarnrc".
#12 0.524 verbose 0.1147057 current time: 2021-07-13T13:55:35.694Z
#12 0.560 [1/4] Resolving packages...
#12 0.766 [2/4] Fetching packages...
#12 0.800 verbose 0.3909134 Performing "GET" request to "https://registry.yarnpkg.com/bytes/-/bytes-3.1.0.tgz".
#12 0.818 verbose 0.4090453 Performing "GET" request to "https://registry.yarnpkg.com/body-parser/-/body-parser-1.19.0.tgz".
#12 0.821 verbose 0.4115124 Performing "GET" request to "https://registry.yarnpkg.com/debug/-/debug-2.6.9.tgz".
#12 0.823 verbose 0.4138139 Performing "GET" request to "https://registry.yarnpkg.com/content-type/-/content-type-1.0.4.tgz".
#12 0.827 verbose 0.4176404 Performing "GET" request to "https://registry.yarnpkg.com/depd/-/depd-1.1.2.tgz".
#12 0.829 verbose 0.4196913 Performing "GET" request to "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz".
#12 0.831 verbose 0.4214504 Performing "GET" request to "https://registry.yarnpkg.com/http-errors/-/http-errors-1.7.2.tgz".
#12 0.832 verbose 0.4227839 Performing "GET" request to "https://registry.yarnpkg.com/on-finished/-/on-finished-2.3.0.tgz".
#12 1.163 verbose 0.7540239 Error: unable to get local issuer certificate
#12 1.163 at TLSSocket.onConnectSecure (_tls_wrap.js:1502:34)
#12 1.163 at TLSSocket.emit (events.js:314:20)
#12 1.163 at TLSSocket._finishInit (_tls_wrap.js:937:8)
#12 1.163 at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:711:12)
#12 1.166 error An unexpected error occurred: "https://registry.yarnpkg.com/bytes/-/bytes-3.1.0.tgz: unable to get local issuer certificate".
#12 1.166 info If you think this is a bug, please open a bug report with the information provided in "/app/yarn-error.log".
#12 1.166 info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.

executor failed running [/bin/sh -c yarn install --production --verbose]: exit code: 1

Q: Are there any glaring errors made to the original script that need to be corrected?
Q: Any suggestions as to my next steps?

Thank you,
Stephen

wald-tq · 2021-07-14T13:30:41Z

@stephenpatten: your Dockerfile looks good to me. Can't spot any errors. To debug the issue I would try the setup manually on command line and check if the certificate file is correct and contains all the certificates of the chain.

icecream17 · 2021-10-21T13:25:07Z

renovate is getting this error; am i doing something wrong?

icecream17/solver#115 (comment)

gabsoftware · 2021-11-16T09:48:48Z

On Windows I solved the issue by adding the following environment variable: NODE_EXTRA_CA_CERTS=C:\path\to\ca.pem where ca.pem is the chain certificate of the corporate CA that I exported from Firefox.
It will not work if you also set NODE_OPTIONS=--use-openssl-ca so only set NODE_EXTRA_CA_CERTS.

Uzef1997 · 2022-08-10T06:09:03Z

I had the same issue under the same circumstances but I ran this command yarn config set strict-ssl false and it worked.

It worked Thanks buddy

s9m33r · 2022-09-11T13:07:55Z

I got this error when I tried to install jquery package. Upon tons of re-search finally found that Neither should one set the strict-ssl to false nor should edit the .yarnrc file. The clean and ideal approach for this is -
$ yarn config set cafile "/physical/path/to/certificate-file.pem" and that's it. I was successfully able to install jquery without turning off SSL after firing this command.
One can always check the configuration with yarn before and after the above command yarn config list and ensure if the change we made above has taken place or not, which generally it does. :)

Folks don't go for disabling strict-ssl. The quoted comment by @sandipt27 is the most comprehensive answer on this issue.

ZiaCodes · 2024-03-26T10:11:19Z

etter to fix it as soon as possible.

Having the same issue with git push

But working after git config --global http.sslbackend schannel

but now again having same issue with yarn

vbfox mentioned this issue Oct 13, 2016

Self signed certificate in certificate chain error #980

Closed

sebmck added the needs triage label Oct 14, 2016

sebmck closed this as completed Oct 15, 2016

rzontar mentioned this issue Oct 19, 2016

yarn config unable to set boolean value #1237

Closed

francisoud mentioned this issue Oct 21, 2016

strict-ssl=false in .npmrc file is not use by yarn #1333

Closed

wyze removed the needs triage label Nov 10, 2016

akosyakov mentioned this issue Sep 14, 2017

Working with the code in VS.Net 2017 eclipse-theia/theia#509

Closed

tatsujb mentioned this issue Feb 7, 2018

🙋 feature : up-to-date tienne/angular-parcel#1

Open

blink1073 mentioned this issue Sep 27, 2018

webpack command not found, node_modules folder is missing jupyterlab/jupyterlab#5157

Closed

FranklinYu mentioned this issue Oct 24, 2018

Trust the system root CA certificates #6578

Open

a-b-r-o-w-n mentioned this issue Mar 2, 2020

Yarn install Bug microsoft/BotFramework-Composer#2104

Closed

7 tasks

lex111 mentioned this issue Apr 3, 2020

unable to get local issuer certificate facebook/docusaurus#2517

Closed

mwiede mentioned this issue Mar 1, 2022

Unable to execute openapi-generator-cli version[BUG] OpenAPITools/openapi-generator-cli#390

Open

andrewrhunt mentioned this issue Apr 14, 2023

Clone step fails due to missing local corporate CA docker/getting-started#158

Open

error unable to get local issuer certificate #841

error unable to get local issuer certificate #841

Comments

kevincaradant commented Oct 12, 2016 • edited Loading

hallatore commented Oct 12, 2016

vbfox commented Oct 12, 2016

aurokin commented Oct 12, 2016

YosefLm commented Oct 13, 2016

zwik commented Oct 13, 2016

chronicIntrovert commented Oct 13, 2016

roby2001 commented Oct 13, 2016

stonefishy commented Oct 14, 2016

mikebranski commented Oct 14, 2016

chlunde commented Oct 14, 2016

sebmck commented Oct 15, 2016

elliotwesoff commented Mar 3, 2017 • edited Loading

jeffbski commented Apr 7, 2017

sylvesteraswin commented Apr 17, 2017 • edited Loading

jeffbski commented Apr 17, 2017

darul75 commented Apr 21, 2017 • edited Loading

damiandennis commented May 2, 2017

JesterXL commented Jul 5, 2017

UdaySravanK commented Jul 20, 2017

ao commented Aug 8, 2017

afrazahmad21 commented Aug 17, 2017 • edited Loading

BYK commented Aug 18, 2017

snood1205 commented Sep 27, 2017

Veske commented Feb 6, 2018

shabeermothi commented Feb 18, 2018

Veske commented Feb 5, 2019 • edited Loading

Kielan commented Mar 4, 2019 • edited Loading

beejei commented Nov 18, 2019

devashu9 commented Nov 24, 2019

sandipt27 commented Nov 27, 2019 • edited Loading

FranklinYu commented Nov 27, 2019 • edited Loading

beejei commented Dec 10, 2019

sandipt27 commented Dec 18, 2019

michaeloryl commented Jan 16, 2020

cben commented Jun 8, 2020

wald-tq commented Mar 19, 2021

adjenks commented Jun 17, 2021

wald-tq commented Jul 5, 2021

adjenks commented Jul 6, 2021

stephenpatten commented Jul 13, 2021 • edited Loading

wald-tq commented Jul 14, 2021

icecream17 commented Oct 21, 2021 • edited Loading

gabsoftware commented Nov 16, 2021

Uzef1997 commented Aug 10, 2022

s9m33r commented Sep 11, 2022 • edited Loading

ZiaCodes commented Mar 26, 2024

kevincaradant commented Oct 12, 2016 •

edited

Loading

elliotwesoff commented Mar 3, 2017 •

edited

Loading

sylvesteraswin commented Apr 17, 2017 •

edited

Loading

darul75 commented Apr 21, 2017 •

edited

Loading

afrazahmad21 commented Aug 17, 2017 •

edited

Loading

Veske commented Feb 5, 2019 •

edited

Loading

Kielan commented Mar 4, 2019 •

edited

Loading

sandipt27 commented Nov 27, 2019 •

edited

Loading

FranklinYu commented Nov 27, 2019 •

edited

Loading

stephenpatten commented Jul 13, 2021 •

edited

Loading

icecream17 commented Oct 21, 2021 •

edited

Loading

s9m33r commented Sep 11, 2022 •

edited

Loading