VPN, proxy and filters

Corporate proxy certificates break Terminal tools on a Mac

Some company networks inspect HTTPS traffic. The proxy then signs the traffic with a company root certificate, and tools that do not trust it stop.

Applies to: All current macOS versions. Node.js NODE_USE_SYSTEM_CA needs Node.js 22.19, 24.6 or later.Checked: 29 October 2026

Symptoms

npm or Node shows “self-signed certificate in certificate chain” or “unable to get local issuer certificate”.
Git shows “SSL certificate problem” for HTTPS remotes.
Safari opens the site, but curl or Python does not.
The errors occur only on the company network or VPN.

TLS inspection. The proxy replaces the site's certificate with one that a company root certificate signs.
Separate trust stores. Safari uses the macOS keychain. Many command-line tools use their own list of trusted certificates.
A missing proxy setting. Tools in Terminal do not always use the system proxy. They need proxy variables or their own setting.

Show the certificate chain that the server sends. Look at the issuer of the top certificate.

openssl s_client -connect registry.npmjs.org:443 -servername registry.npmjs.org -showcerts </dev/null

Show the TLS handshake with curl.

curl -v https://registry.npmjs.org/ -o /dev/null

Find the company root certificate in Keychain Access. Search for your company name in the System keychain.
Show the proxy variables in your shell.
```
env | grep -i proxy
```

Get the company root certificate from your IT team as a PEM file. Do not trust a certificate from an unknown source.
For Node.js tools, give the file in NODE_EXTRA_CA_CERTS. Start the tool again after you set it.
```
export NODE_EXTRA_CA_CERTS=~/certs/company-root.pem
```
With Node.js 22.19, 24.6 or later, you can use the certificates that the keychain trusts.
```
export NODE_USE_SYSTEM_CA=1
```

For npm, set the certificate file.

npm config set cafile ~/certs/company-root.pem

For Git, set the certificate file.

git config --global http.sslCAInfo ~/certs/company-root.pem

For curl, give the file with --cacert.

curl --cacert ~/certs/company-root.pem https://example.com

Set the company proxy for Terminal tools if your IT team uses one.
```
export https_proxy=http://proxy.example.com:8080
```
Do not turn off certificate checks, such as strict-ssl or http.sslVerify. This makes the connection unsafe.

Kilobat's connection check reports a TLS failure as its own layer. It also says if the system proxy works where the direct path does not.
```
kilobat why https://registry.npmjs.org/
```
Add --app to use the proxy variables of that app's environment.
```
kilobat why https://registry.npmjs.org/ --app process:node
```

Why does Safari work when npm fails?

Safari trusts the certificates in the macOS keychain. npm uses the certificates that Node.js includes, unless you add the company certificate.

Is it safe to set strict-ssl to false?

No. It stops all certificate checks for the registry. Add the company root certificate instead.

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.