NPM install Error: self signed certificate in certificate chain

Question

At my company, there is an auto signed ssl certificate. So they're some npm packages that cannot be installed because of it.

I already add strict-ssl=false in .npmrc or --strict-ssl=false command args.

It works for some packages but some doesn't seems to take in charge this option.

For exemple, I tried to install Cypress :

Command :

npm i cypress --save-dev --strict-ssl=false

Error logs :

> [email protected] postinstall /Users/mchoraine/Documents/Workplace/SAMSE/rechercheproduit/rechercheproduit-front/node_modules/cypress
> node index.js --exec install

Installing Cypress (version: 3.4.0)

 ✖  Downloading Cypress    
   → Cypress Version: 3.4.0
    Unzipping Cypress      
    Finishing Installation 
The Cypress App could not be downloaded.

Please check network connectivity and try again:

----------

URL: https://download.cypress.io/desktop/3.4.0?platform=darwin&arch=x64
Error: self signed certificate in certificate chain

----------

Platform: darwin (18.6.0)
Cypress Version: 3.4.0

Problem seems to occur only for packages with postinstall

The smartest things would be to change the SSL certificate but unfortunately it can't be done.

So are you aware of an alternative to bypass certificat verification on npm postinstall ?

Thanks in advance for your proposal.

Answer 1

Get a copy of your company's certificate, then set the NODE_EXTRA_CA_CERTS environmental variable to point to it before you run the npm commnand:

export NODE_EXTRA_CA_CERTS=path/to/certificate.crt

The post-install script is a separate node program, so the npm flag doesn't affect it.

Credit goes to "zerdos" who posted this solution on a related GitHub issue: https://github.com/cypress-io/cypress/issues/1401#issuecomment-393591520

Answer 2

For me the following solution worked.

OS - windows 10

Terminal - git bash

Run these commands before installing cypress.

setx HTTP_PROXY <your company proxy url>
setx NODE_EXTRA_CA_CERTS <path to cerm.pem file>

These will be set as environment variables in your system for any future use. You can always get rid of them anytime if you do not need them.