Fix npm/pip/git SSL CERTIFICATE_VERIFY_FAILED behind a corporate proxy

The problem

Behind the corporate TLS-intercepting proxy, every package manager failed:

npm error code SELF_SIGNED_CERT_IN_CHAIN

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
unable to get local issuer certificate (_ssl.c:1010)

fatal: unable to access 'https://github.com/...': SSL certificate problem:
self-signed certificate in certificate chain

What didn't work

NODE_TLS_REJECT_UNAUTHORIZED=0 and git -c http.sslVerify=false — everything "works" and every TLS connection is now unauthenticated, which is a credential-theft gift to anything on the network path.
Pointing NODE_EXTRA_CA_CERTS at the proxy's leaf certificate for one site — fails, because the proxy re-signs everything with its own ROOT CA, so the leaf changes per-host while the root doesn't.
export HTTPS_PROXY=... alone — routes the traffic but doesn't fix the trust store, so the verification errors remain.

The fix

Trust the proxy's root CA in each tool's store:

# 1. capture the proxy's chain (it intercepts TLS, so the top cert is its root):
openssl s_client -connect registry.npmjs.org:443 -proxy proxy.corp:8080 -showcerts </dev/null 2>/dev/null \
  | awk '/BEGIN CERT/,/END CERT/{print}' > corp-chain.pem

# 2. install it as a system trust anchor (Debian/Ubuntu) — covers curl, apt-transport, most CLIs:
sudo cp corp-chain.pem /usr/local/share/ca-certificates/corp-root.crt
sudo update-ca-certificates

# 3. node: APPENDS to the built-in bundle (does not replace it):
export NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/corp-root.crt

# 4. python and git:
export PIP_CERT=/usr/local/share/ca-certificates/corp-root.crt
git config --global http.sslCAInfo /usr/local/share/ca-certificates/corp-root.crt

Why it works

The proxy re-signs every TLS connection with its own root, so the only correct fix is trusting that root — per tool, in its own trust store. NODE_EXTRA_CA_CERTS appends to Node's bundle rather than replacing it, and the system store covers everything else in one shot.

Continue reading — $1/month

The full fix, verbatim, plus every other solution in the feed.