---
title: "Corporate proxy certificate errors in npm, Git, curl on Mac · Kilobat Guides"
url: "https://kilobat.app/guides/corporate-proxy-certificates"
description: "Fix “unable to get local issuer certificate” in npm, Node, Git, curl and Homebrew behind a company proxy, without turning off certificate checks."
---

VPN, proxy and filters

# Corporate proxy certificates break Terminal tools on a Mac

Some company networks inspect HTTPS traffic. The proxy then signs the traffic with a company root certificate, and tools that do not trust it stop.

Applies to: All current macOS versions. Node.js `NODE_USE_SYSTEM_CA` needs Node.js 22.19, 24.6 or later. · Checked: 29 October 2026

## Symptoms

- npm or Node shows “self-signed certificate in certificate chain” or “unable to get local issuer certificate”.
- Git shows “SSL certificate problem” for HTTPS remotes.
- Safari opens the site, but curl or Python does not.
- The errors occur only on the company network or VPN.

## Likely causes

- **TLS inspection.** The proxy replaces the site's certificate with one that a company root certificate signs.
- **Separate trust stores.** Safari uses the macOS keychain. Many command-line tools use their own list of trusted certificates.
- **A missing proxy setting.** Tools in Terminal do not always use the system proxy. They need proxy variables or their own setting.

## How to check

1. Show the certificate chain that the server sends. Look at the issuer of the top certificate.

   ```
   openssl s_client -connect registry.npmjs.org:443 -servername registry.npmjs.org -showcerts </dev/null
   ```
2. Show the TLS handshake with curl.

   ```
   curl -v https://registry.npmjs.org/ -o /dev/null
   ```
3. Find the company root certificate in Keychain Access. Search for your company name in the System keychain.
4. Show the proxy variables in your shell.

   ```
   env | grep -i proxy
   ```

## How to fix it

1. Get the company root certificate from your IT team as a PEM file. Do not trust a certificate from an unknown source.
2. For Node.js tools, give the file in `NODE_EXTRA_CA_CERTS`. Start the tool again after you set it.

   ```
   export NODE_EXTRA_CA_CERTS=~/certs/company-root.pem
   ```
3. With Node.js 22.19, 24.6 or later, you can use the certificates that the keychain trusts.

   ```
   export NODE_USE_SYSTEM_CA=1
   ```
4. For npm, set the certificate file.

   ```
   npm config set cafile ~/certs/company-root.pem
   ```
5. For Git, set the certificate file.

   ```
   git config --global http.sslCAInfo ~/certs/company-root.pem
   ```
6. For curl, give the file with `--cacert`.

   ```
   curl --cacert ~/certs/company-root.pem https://example.com
   ```
7. Set the company proxy for Terminal tools if your IT team uses one.

   ```
   export https_proxy=http://proxy.example.com:8080
   ```
8. Do not turn off certificate checks, such as `strict-ssl` or `http.sslVerify`. This makes the connection unsafe.

## With Kilobat

1. Kilobat's connection check reports a TLS failure as its own layer. It also says if the system proxy works where the direct path does not.

   ```
   kilobat why https://registry.npmjs.org/
   ```
2. Add `--app` to use the proxy variables of that app's environment.

   ```
   kilobat why https://registry.npmjs.org/ --app process:node
   ```

## Questions

**Why does Safari work when npm fails?**

Safari trusts the certificates in the macOS keychain. npm uses the certificates that Node.js includes, unless you add the company certificate.

**Is it safe to set strict-ssl to false?**

No. It stops all certificate checks for the registry. Add the company root certificate instead.

## Sources

- [Node.js: Command-line API, NODE_EXTRA_CA_CERTS and --use-system-ca](https://nodejs.org/api/cli.html)
- [npm Docs: config (cafile, proxy, https-proxy, strict-ssl)](https://docs.npmjs.com/cli/v11/using-npm/config)
- git-config(1), http.sslCAInfo and http.proxy, man page installed with macOS 27.2 (Git 2.56)
- [Apple Support: Change the trust settings of a certificate in Keychain Access](https://support.apple.com/guide/keychain-access/kyca11871)
- curl(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

## Related guides

- [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails): Homebrew downloads with curl and Git.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps): A proxy setting sends traffic through another server.
- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac): Safari shows a certificate warning when it cannot confirm the identity of a website.
- [SSH and Git time out on a Mac](https://kilobat.app/guides/ssh-git-timeouts): SSH and Git need a working TCP connection to the server.