This Node.js error means the certificate chain presented by the server couldn't be fully verified against Node's built-in trust store — often a actually incomplete chain on the server side, rather than a Node-specific configuration issue.
The fix
First, verify the target server's certificate chain is in fact complete using an independent tool (an SSL checker, or OpenSSL ) — if the chain is actually broken, the fix belongs on that server, not in your Node code. Setting NODE_TLS_REJECT_UNAUTHORIZED=0 as a workaround disables certificate validation entirely and should be avoided outside of clearly controlled local development against a known, trusted self-signed certificate.
What this Node.js-specific error message really means
This error indicates Node.js's TLS implementation couldn't validate the signature on the leaf (end-entity) certificate against the chain it received — commonly caused by an incomplete certificate chain from the server, the same root cause covered throughout this site's chain-related troubleshooting content.
How Node.js's certificate handling differs from a browser's more forgiving approach
Node.js's TLS module performs stricter chain validation than many browsers' more forgiving, cache-assisted approach, meaning a chain that appears to work fine in casual browser testing can still fail specifically in a Node.js application — reinforcing why testing with your actual production runtime, not just a browser, matters for catching this class of issue.
What NODE_EXTRA_CA_CERTS environment variable does for testing against internal CAs
Setting the NODE_EXTRA_CA_CERTS environment variable to point at a specific additional CA certificate file lets Node.js trust that CA for testing purposes without needing to modify your system-wide trust store, useful in particular for internal or development certificate scenarios.
How to distinguish this error from a completely different, unrelated Node.js TLS issue
Reading the full error object's code property (commonly UNABLE_TO_VERIFY_LEAF_SIGNATURE for this specific issue) rather than just the message text distinguishes this specific chain-related error from other, differently-coded Node.js TLS errors that might superficially look similar in a truncated log line.
What the exact syntax looks like for setting NODE_EXTRA_CA_CERTS correctly
Setting the environment variable before starting your Node.js application, NODE_EXTRA_CA_CERTS=/path/to/ca.pem node app.js, or configuring it in your deployment environment's environment variables, adds the specified certificate to Node's trusted set without needing to modify Node's own bundled trust store.
How this environment variable differs from Node's rejectUnauthorized option
NODE_EXTRA_CA_CERTS adds an additional trusted certificate while keeping full validation active; setting rejectUnauthorized to false disables certificate validation entirely for all connections — the two are fundamentally different in risk profile, and rejectUnauthorized should never be used in production code.
How this error differs when encountered in a browser-based versus server-side Node.js context
Server-side Node.js code (an API backend, a build script) making outbound HTTPS requests is where this error most commonly surfaces — client-side JavaScript running in an actual browser relies on the browser's own certificate validation instead, meaning this specific Node.js error is inherently a server-side or build-tooling concern.
Loading comments…