UNABLE_TO_VERIFY_LEAF_SIGNATURE

What the error actually means #

“The first certificate” is the one at the bottom of the chain — the server’s own. Node could not verify its signature, because it does not have the certificate of whoever signed it.

That is almost always because the server did not send it. A TLS server is required to present its own certificate and every intermediate needed to reach a trusted root; sending only the leaf is the single most common TLS misconfiguration on the internet.

Which Node TLS error do you have? #

Node’s codes are precise, and each points at a different problem. Read yours out of the error object before doing anything else:

Step 1 — confirm the chain is short #

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
| grep -c "BEGIN CERTIFICATE"

1

A single certificate from a publicly trusted CA confirms the diagnosis. Two or more, and the chain is complete — in which case you have a different error code, and the table above is the right place to look.

Step 2 — fix the server, if it is yours #

Concatenate the certificate and its intermediates into one file, leaf first, walking upward:

cat certificate.crt chain.crt > fullchain.crt

Prove it validates before deploying it. -untrusted supplies the intermediates that the chain needs but that are not themselves trust anchors:

openssl verify -CAfile root-ca.crt -untrusted chain.crt certificate.crt

certificate.crt: OK

Then point the server at fullchain.crt rather than at the bare certificate — nginx in particular has no separate chain directive, so ssl_certificate must name the combined file. The per-server configuration is on install an SSL certificate on nginx.

Step 3 — where the server is not yours #

Supply the missing issuer to Node directly. Save the intermediate as PEM and name it:

export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/intermediate.pem
node app.js

For a single request, pass the certificate in code instead of changing the environment:

import { readFileSync } from 'node:fs';
import https from 'node:https';

const agent = new https.Agent({
ca: readFileSync('/etc/ssl/certs/intermediate.pem'),
});

https.get('https://example.com/', { agent }, (res) => {
console.log(res.statusCode);
});

Or take the OpenSSL system store instead of Node’s bundled list, which is the right choice on a machine where a corporate root is already installed:

node --use-openssl-ca app.js

npm, yarn and pnpm #

The package managers use the same TLS stack and surface the same code. Point them at a bundle containing the missing issuer:

What not to do #