[BUG] Unable to install packages w/ brew linked node | macOS | NODE_EXTRA_CA_CERTS defined, behind ZScaler firewall

[pradeep-shanmugham]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm install used to work before, but has stopped working recently, unsure why.

• Work in an organization where Zscaler is installed on machines by IT.
• EXTRA_NODE_CA_CERTS has been defined with a file that has the ZScaler certificate chain as per: https://help.zscaler.com/zia/adding-custom-certificate-application-specific-trust-store
• cafile also mentioned in npm config
• Able to download packages if I supply --strict-ssl=false on command line / if is set in npm config.

Expected Behavior

Able to download packages without supplying --strict-ssl=false on command line

Steps To Reproduce

1. macOS 14.5 (23F79) Sonoma

2. With environment variable
   NODE_EXTRA_CA_CERTS
   /Users/pradeep-shanmugham/certs/ZscalerRootCA.pem

3. Run npm install @angular/cdk

4. See error below:

0 verbose cli /Users/pradeep-shanmugham/.nvm/versions/node/v20.14.0/bin/node /Users/pradeep-shanmugham/.nvm/versions/node/v20.14.0/bin/npm
1 info using npm@10.7.0
2 info using node@v20.14.0
3 silly config:load:file:/Users/pradeep-shanmugham/.nvm/versions/node/v20.14.0/lib/node_modules/npm/npmrc
4 silly config:load:file:/Users/pradeep-shanmugham/code/temp2/.npmrc
5 silly config:load:file:/Users/pradeep-shanmugham/.npmrc
6 silly config:load:file:/Users/pradeep-shanmugham/.nvm/versions/node/v20.14.0/etc/npmrc
7 verbose title npm install @angular/cdk
8 verbose argv "install" "@angular/cdk" "--loglevel" "verbose"
9 verbose logfile logs-max:10 dir:/Users/pradeep-shanmugham/.npm/_logs/2024-06-13T00_04_54_298Z-
10 verbose logfile /Users/pradeep-shanmugham/.npm/_logs/2024-06-13T00_04_54_298Z-debug-0.log
11 silly logfile start cleaning logs, removing 1 files
12 silly logfile done cleaning log files
13 silly idealTree buildDeps
14 silly fetch manifest @angular/cdk@^18.0.3
15 http fetch GET https://registry.npmjs.org/@angular%2fcdk attempt 1 failed with UNABLE_TO_GET_ISSUER_CERT_LOCALLY
16 http fetch GET https://registry.npmjs.org/@angular%2fcdk attempt 2 failed with UNABLE_TO_GET_ISSUER_CERT_LOCALLY
17 http fetch GET https://registry.npmjs.org/@angular%2fcdk attempt 3 failed with UNABLE_TO_GET_ISSUER_CERT_LOCALLY
18 silly placeDep ROOT @angular/cdk@ REPLACE for:  want: ^18.0.3
19 verbose type system
20 verbose stack FetchError: request to https://registry.npmjs.org/@angular%2fcdk failed, reason: unable to get local issuer certificate
20 verbose stack     at ClientRequest.<anonymous> (/Users/pradeep-shanmugham/.nvm/versions/node/v20.14.0/lib/node_modules/npm/node_modules/minipass-fetch/lib/index.js:130:14)
20 verbose stack     at ClientRequest.emit (node:events:519:28)
20 verbose stack     at _destroy (node:_http_client:880:13)
20 verbose stack     at onSocketNT (node:_http_client:900:5)
20 verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:83:21)
21 verbose cwd /Users/pradeep-shanmugham/code/temp2
22 verbose Darwin 23.5.0
23 verbose node v20.14.0
24 verbose npm  v10.7.0
25 error code UNABLE_TO_GET_ISSUER_CERT_LOCALLY
26 error errno UNABLE_TO_GET_ISSUER_CERT_LOCALLY
27 error request to https://registry.npmjs.org/@angular%2fcdk failed, reason: unable to get local issuer certificate
28 verbose exit 1
29 verbose code 1
30 silly unfinished npm timer reify 1718237094430
31 silly unfinished npm timer reify:loadTrees 1718237094431
32 error A complete log of this run can be found in: /Users/pradeep-shanmugham/.npm/_logs/2024-06-13T00_04_54_298Z-debug-0.log

Environment

• npm: 10.7.0
• Node.js: v20.14.0
• OS Name: macOS 14.5 (23F79)
• System Model Name: Apple M3 Max
• npm config:

; "user" config from /Users/pradeep-shanmugham/.npmrc

ca = ["/Users/pradeep-shanmugham/certs/ZscalerRootCA.pem"] 
cafile = "/Users/pradeep-shanmugham/certs/ZscalerRootCA.pem" 
strict-ssl = true 

; node bin location = /Users/pradeep-shanmugham/.nvm/versions/node/v20.14.0/bin/node
; node version = v20.14.0
; npm local prefix = /Users/pradeep-shanmugham/code/test-app
; npm version = 10.7.0
; cwd = /Users/pradeep-shanmugham/code/test-app
; HOME = /Users/pradeep-shanmugham

[pradeep-shanmugham]

Downgraded to v.18 of node - issue remained

Unlinked from brew
brew unlink node
Then cleaned up ca and cafile properties in .npmrc at both project and user level.
now works with just the NODE_EXTRA_CA_CERTS env variable...

Upgraded back to v.20, continues to work post clearing cache forcibly

Issue seems to be when linked to brew.

[milaninfy]

@pradeep-shanmugham This doesn't look like issue with npm
checkout this similer issue and comments #7326