yarn install crashes with the error self signed certificate in certificate chain

[adamduren]

Do you want to request a _feature_ or report a _bug_?
Bug

What is the current behavior?
yarn install crashes with the error self signed certificate in certificate chain

If the current behavior is a bug, please provide the steps to reproduce.

1. Create a package.json with a URL that has a self signed certificate. In this case it is a .tgz in our infrastructure.
2. Run yarn install

What is the expected behavior?

1. yarn install exits without error.

Please mention your node.js, yarn and operating system version.

node: 6.3.1
yarn: 0.15.1
OS: OS X Sierra

[adamduren]

Full stacktrace

➜  projectDir git:(master) ✗ yarn install
yarn install v0.15.1
[1/4] 🔍  Resolving packages...
error self signed certificate in certificate chain
    at Error (native)
    at TLSSocket.<anonymous> (_tls_wrap.js:1060:38)
    at emitNone (events.js:86:13)
    at TLSSocket.emit (events.js:185:7)
    at TLSSocket._finishInit (_tls_wrap.js:584:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:416:38)
info Visit http://yarnpkg.com/en/docs/cli/install for documentation about this command.

[Daniel15]

This is SSL/TLS working as expected, it's rejecting invalid certs 😄 . If this validation was not performed, someone could perform a man-in-the-middle attack.

Try running Yarn like this:

NODE_TLS_REJECT_UNAUTHORIZED=0 yarn install

or running export NODE_TLS_REJECT_UNAUTHORIZED=0 before yarn install.

This is pretty dangerous though, as it totally turns off TLS validation for every request performed from Node.js while the environment variable is set. A better approach for internal services is to either use a real certificate (which could be a free Let's Encrypt one) or have an internal CA, install its root cert on developer machines, and then use certificates from that CA for internal services (this is what we do at Facebook)

Potentially we could add a setting to ignore TLS validation errors for particular hostnames (so we'd still validate for the regular npm server and only turn off validation for your internal server) but I don't know whether that's worth the maintenance overhead of keeping such a feature.

[adamduren]

Thank you, I believe I have the cert installed but will research further. Closing for now.

[JanEggers]

same problem here but on windows

if i run

set NODE_TLS_REJECT_UNAUTHORIZED=0
yarn install

yarn still fails with certificate error (caused by corporate proxy)

@adamduren is there some other option on windows?

[eneskoroglu]

@JanEggers you can try executing below command:

yarn config set "strict-ssl" false

[mazedlx]

I'm sitting behind a company Firewall which can decrypt any SSL traffic. Installing packages with a cafile config option within .yarnrc works fine, but it failed when running pngquant et. al. postinstall routines. Thank you!

[JoanComasFdz]

I had this issue in Windows 10 1709 16299.967.

I had to:

1. Open PowerShell as Admin.
2. Install yarn with chocolatey: choco install yarn.
3. Close PowerShell.
4. Open PowerShell as Admin.
5. Execute yarn once: yarn.
6. Configure the ssl: yarn config set "strict-ssl" false.

[mrojas18]

works form me doing just:
Open powershell as admin
execute: yarn config set strict-ssl false.

[Hichem-elAbassi]

Please stop setting SSL to false , not only you can get hacked very badly but also all those innocent people using your services could be victims..
SSL was put in there for a reason , and it's a very logical.

[CatinhoCR]

Please stop setting SSL to false , not only you can get hacked very badly but also all those innocent people using your services could be victims..
SSL was put in there for a reason , and it's a very logical.

So what is the recommended and actual fix to this?

[danesparza]

Please stop setting SSL to false , not only you can get hacked very badly but also all those innocent people using your services could be victims..
SSL was put in there for a reason , and it's a very logical.

So what is the recommended and actual fix to this?

Stop intercepting SSL/TLS calls with your own man-in-the-middle SSL cert. You are breaking TLS.

[CatinhoCR]

Please stop setting SSL to false , not only you can get hacked very badly but also all those innocent people using your services could be victims..
SSL was put in there for a reason , and it's a very logical.

So what is the recommended and actual fix to this?

Stop intercepting SSL/TLS calls with your own man-in-the-middle SSL cert. You are breaking TLS.

Thanks for the reply..

Yes, I do understand this and wouldn't consider that an actual fix anyways. That answers what the fix shouldn't be, but my question is if there's an actual fix to this and how it should be addressed.
There seems to be a fix on Windows in the comments, but it seems like MacOS catalinas are throwing up this error. Setting up LetsEncrypt|OpenSSL etc just to be able to run this locally for development seems quite time consuming but I may be totally wrong, can't find any relevant info.

Edit: Seems like my issue was caused by a proxy.

[felickz]

Please stop setting SSL to false , not only you can get hacked very badly but also all those innocent people using your services could be victims..
SSL was put in there for a reason , and it's a very logical.

So what is the recommended and actual fix to this?

Add your proxy cert authority chain to yarn config (pem or crt):

yarn config set cafile C:\Users\youruser\.certificates\yourcertname.pem