This Node.js error means the certificate chain presented by the server couldn't be fully verified against Node's built-in trust store — often a genuinely incomplete chain on the server side, rather than a Node-specific configuration issue.
The fix
First, verify the target server's certificate chain is actually complete using an independent tool (an SSL checker, or OpenSSL directly) — if the chain is genuinely broken, the fix belongs on that server, not in your Node code. Setting NODE_TLS_REJECT_UNAUTHORIZED=0 as a workaround disables certificate validation entirely and should be avoided outside of clearly controlled local development against a known, trusted self-signed certificate.
What this Node.js-specific error message actually means
This error indicates Node.js's TLS implementation couldn't validate the signature on the leaf (end-entity) certificate against the chain it received — commonly caused by an incomplete certificate chain from the server, the same root cause covered throughout this site's chain-related troubleshooting content.
How Node.js's certificate handling differs from a browser's more forgiving approach
Node.js's TLS module performs stricter chain validation than many browsers' more forgiving, cache-assisted approach, meaning a chain that appears to work fine in casual browser testing can still fail specifically in a Node.js application — reinforcing why testing with your actual production runtime, not just a browser, matters for catching this class of issue.
What NODE_EXTRA_CA_CERTS environment variable does for testing against internal CAs
Setting the NODE_EXTRA_CA_CERTS environment variable to point at a specific additional CA certificate file lets Node.js trust that CA for testing purposes without needing to modify your system-wide trust store, useful specifically for internal or development certificate scenarios.
How to distinguish this error from a completely different, unrelated Node.js TLS issue
Reading the full error object's code property (commonly UNABLE_TO_VERIFY_LEAF_SIGNATURE for this specific issue) rather than just the message text distinguishes this specific chain-related error from other, differently-coded Node.js TLS errors that might superficially look similar in a truncated log line.
A final note on addressing root cause versus symptom
If this error appears in a Node.js application connecting to your own infrastructure, treating it as a signal to audit your server's certificate chain completeness, rather than only fixing it client-side via NODE_EXTRA_CA_CERTS, addresses the root cause rather than only the symptom for this one specific client.
What the exact syntax looks like for setting NODE_EXTRA_CA_CERTS correctly
Setting the environment variable before starting your Node.js application, NODE_EXTRA_CA_CERTS=/path/to/ca.pem node app.js, or configuring it in your deployment environment's environment variables, adds the specified certificate to Node's trusted set without needing to modify Node's own bundled trust store directly.
How this environment variable differs from Node's rejectUnauthorized option
NODE_EXTRA_CA_CERTS adds an additional trusted certificate while keeping full validation active; setting rejectUnauthorized to false disables certificate validation entirely for all connections — the two are fundamentally different in risk profile, and rejectUnauthorized should essentially never be used in production code.
A quick closing checklist
A quick closing checklist covers confirming whether the server's own chain is genuinely incomplete, using NODE_EXTRA_CA_CERTS only as a temporary testing measure, and fixing the actual server-side chain issue as the real, permanent solution.
How this error specifically differs when encountered in a browser-based versus server-side Node.js context
Server-side Node.js code (an API backend, a build script) making outbound HTTPS requests is where this error most commonly surfaces — client-side JavaScript running in an actual browser relies on the browser's own certificate validation instead, meaning this specific Node.js error is inherently a server-side or build-tooling concern.