node.js npm 安装错误 - 无法获取本地颁发者证书
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/36494336/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
npm install error - unable to get local issuer certificate
提问by mindparse
I am getting an unable to get local issuer certificateerror when performing an npm install:
unable to get local issuer certificate执行 npm 安装时出现错误：
typings ERR! message Unable to read typings for "es6-shim". You should check the
entry paths in "es6-shim.d.ts" are up to date
typings ERR! caused by Unable to connect to "https://raw.githubusercontent.com/D
efinitelyTyped/DefinitelyTyped/7de6c3dd94feaeb21f20054b9f30d5dabc5efabd/es6-shim
/es6-shim.d.ts"
typings ERR! caused by unable to get local issuer certificate
I have recently update to node 4 from a much earlier version and it sounds like node is much more strict when these kind of problems arise.
我最近从更早的版本更新到节点 4，当出现此类问题时，节点听起来要严格得多。
There is an issue discussed herewhich talks about using ca files, but it's a bit beyond my understanding and I'm unsure what to do about it.
这里讨论了一个关于使用 ca 文件的问题，但这有点超出我的理解，我不确定该怎么做。
I am behind a corporate firewall, but I can get to the url fine in a browser without any restriction.
我在公司防火墙后面，但我可以在浏览器中正常访问 url，没有任何限制。
Does anyone have any further insight into this issue and what possible solutions there are?
有没有人对这个问题有任何进一步的了解以及有哪些可能的解决方案？
I'm wondering about reverting to node 0.12 in the meantime :(
我想知道在此期间恢复到节点 0.12 :(
采纳答案by nfiles
Typings can be configured with the ~/.typingsrcconfig file. (~means your home directory)
可以使用配置~/.typingsrc文件配置类型。（~表示您的主目录）
After finding this issue on github: https://github.com/typings/typings/issues/120, I was able to hack around this issue by creating ~/.typingsrcand setting this configuration:
在 github 上发现此问题后：https: //github.com/typings/typings/issues/120，我能够通过创建~/.typingsrc和设置此配置来解决此问题：
{
"proxy": "http://<server>:<port>",
"rejectUnauthorized": false
}
It also seemed to work without the proxysetting, so maybe it was able to pick that up from the environment somewhere.
它似乎在没有proxy设置的情况下也能工作，所以也许它能够从某个地方的环境中提取出来。
This is not a true solution, but was enough for typingsto ignore the corporate firewall issues so that I could continue working. I'm sure there is a better solution out there.
这不是一个真正的解决方案，但足以typings忽略公司防火墙问题，以便我可以继续工作。我相信那里有更好的解决方案。
回答by Sam Jacob Dev
Try
尝试
npm config set strict-ssl false
npm config set strict-ssl false
This is a alternative shared in this url https://github.com/nodejs/node/issues/3742
这是此网址中共享的替代方案https://github.com/nodejs/node/issues/3742
回答by Tim L
There is an issue discussed here which talks about using ca files, but it's a bit beyond my understanding and I'm unsure what to do about it.
这里讨论了一个关于使用 ca 文件的问题，但这有点超出我的理解，我不确定该怎么做。
This isn't too difficult once you know how! For Windows:
一旦你知道如何，这并不太难！对于 Windows：
Using Chrome go to the root URL NPM is complaining about (so https://raw.githubusercontent.comin your case). Open up dev tools and go to Security-> View Certificate. Check Certification path and make sure your at the top level certificate, if not open that one. Now go to "Details" and export the cert with "Copy to File...".
使用 Chrome 转到 NPM 抱怨的根 URL（因此在您的情况下为https://raw.githubusercontent.com）。打开开发工具并转到安全-> 查看证书。检查认证路径并确保您在顶级证书，如果没有打开那个。现在转到“详细信息”并使用“复制到文件...”导出证书。
You need to convert this from DER to PEM. There are several ways to do this, but the easiest way I found was an online tool which should be easy to find with relevant keywords.
您需要将其从 DER 转换为 PEM。有几种方法可以做到这一点，但我发现最简单的方法是使用相关关键字很容易找到的在线工具。
Now if you open the key with your favorite text editor you should see
现在，如果你用你最喜欢的文本编辑器打开密钥，你应该看到
-----BEGIN CERTIFICATE-----
yourkey
-----END CERTIFICATE-----
This is the format you need. You can do this for as many keys as you need, and combine them all into one file. I had to do github and the npm registry keys in my case.
这是您需要的格式。您可以根据需要对任意数量的键执行此操作，并将它们全部合并到一个文件中。在我的情况下，我必须做 github 和 npm 注册表项。
Now just edit your .npmrc to point to the file containing your keys like so
现在只需编辑您的 .npmrc 以指向包含您的密钥的文件，就像这样
cafile=C:\workspace\rootCerts.crt
I have personally found this to perform significantly better behind our corporate proxy as opposed to the strict-ssl option. YMMV.
我个人发现这在我们的公司代理后表现明显优于严格 ssl 选项。天啊。
回答by Yogesh Kumar
Use the command
使用命令
npm config set strict-ssl false
回答by Nilesh Godhani
Anyone gets this error when 'npm install' is trying to fetch a package from HTTPS server with a self-signed or invalid certificate.
当“npm install”尝试从带有自签名或无效证书的 HTTPS 服务器获取包时，任何人都会收到此错误。
Quick and insecure solution:
快速且不安全的解决方案：
npm config set strict-ssl false
Why this solution is insecure? The above command tells npm to connect and fetch module from server even server do not have valid certificate and server identity is not verified. So if there is a proxy server between npm client and actual server, it provided man in middle attack opportunity to an intruder.
为什么这个解决方案不安全？上面的命令告诉 npm 连接并从服务器获取模块，即使服务器没有有效的证书并且服务器身份未被验证。因此，如果 npm 客户端和实际服务器之间存在代理服务器，则它为入侵者提供了中间人攻击机会。
Secure solution:
安全解决方案：
If any module in your package.json is hosted on a server with self-signed CA certificate then npm is unable to identify that server with an available system CA certificates. So you need to provide CA certificate for server validation with the explicit configuration in .npmrc. In .npmrc you need to provide cafile, please refer more detail about cafile configuration here
如果 package.json 中的任何模块托管在具有自签名 CA 证书的服务器上，则 npm 无法使用可用的系统 CA 证书识别该服务器。因此，您需要使用 .npmrc 中的显式配置为服务器验证提供 CA 证书。在 .npmrc 中，您需要提供 cafile，请参阅此处有关 cafile 配置的更多详细信息
cafile=./ca-certs.pem
In ca-certs file, you can add any number of CA certificates(public) that you required to identify servers. The certificate should be in “Base-64 encoded X.509 (.CER)(PEM)” format.
在 ca-certs 文件中，您可以添加识别服务器所需的任意数量的 CA 证书（公共）。证书应采用“Base-64 编码的 X.509 (.CER)(PEM)”格式。
For example,
例如，
# cat ca-certs.pem
DigiCert Global Root CA
=======================
-----BEGIN CERTIFICATE-----
CAUw7C29C79Fv1C5qfPrmAE.....
-----END CERTIFICATE-----
VeriSign Class 3 Public Primary Certification Authority - G5
========================================
-----BEGIN CERTIFICATE-----
MIIE0zCCA7ugAwIBAgIQ......
-----END CERTIFICATE-----
Note: once you provide cafile configuration in .npmrc, npm try to identify all server using CA certificate(s) provided in cafile only, it won't check system CA certificate bundles then. If someone wants all well-known public CA authority certificat bundle then can get from here.
注意：一旦您在 .npmrc 中提供 cafile 配置，npm 会尝试仅使用 cafile 中提供的 CA 证书来识别所有服务器，然后它不会检查系统 CA 证书包。如果有人想要所有知名的公共 CA 权威证书包，那么可以从这里获取。
One other situation when you get this error:
出现此错误时的另一种情况：
If you have mentioned Git URL as a dependency in package.json and git is on invalid/self-signed certificate then also npm throws a similar error. You can fix it with following configuration for git client
如果您在 package.json 中提到 Git URL 作为依赖项，并且 git 在无效/自签名证书上，那么 npm 也会抛出类似的错误。您可以使用 git 客户端的以下配置来修复它
git config --global http.sslVerify false
回答by Henry
Add:
添加：
process.env["NODE_TLS_REJECT_UNAUTHORIZED"]
Source: Ignore invalid self-signed ssl certificate in node.js with https.request?
回答by Benson
A disclaimer: This solution is less secure, bad practice, don't do this.I had a duplicate error message--I'm behind a corporate VPN/firewall. I was able to resolve this issue by adding a .typingsrc file to my user directory (C:\Users\MyUserName\.typingsrcin windows). Of course, anytime you're circumventing SSL you should be yapping to your sys admins to fix the certificate issue.
免责声明：此解决方案不太安全，不好的做法，不要这样做。我有一条重复的错误消息——我在公司 VPN/防火墙后面。我能够通过将 .typingsrc 文件添加到我的用户目录（C:\Users\MyUserName\.typingsrc在 Windows 中）来解决这个问题。当然，无论何时您要绕过 SSL，您都应该向您的系统管理员求助以解决证书问题。
Change the registry URL from httpsto http, and as seen in nfiles' answserabove, set rejectUnauthorizedto false.
将注册表 URL 从https更改为http，如上面nfiles 的回答所示，将rejectUnauthorized设置 为false。
.typingsrc(placed in project directory or in user root directory)
.typingsrc（放置在项目目录或用户根目录中）
{
"rejectUnauthorized": false,
"registryURL": "http://api.typings.org/"
}
Optionally add your github token (I didn't find success until I had added this too.)
（可选）添加您的 github 令牌（直到我也添加了它，我才发现成功。）
{
"rejectUnauthorized": false,
"registryURL": "http://api.typings.org/",
"githubToken": "YourGitHubToken"
}
See instructions for setting up your github token at https://github.com/blog/1509-personal-api-tokens
在https://github.com/blog/1509-personal-api-tokens 上查看有关设置 github 令牌的说明
回答by Sam
Well this is not a right answer but can be consider as a quick workaround. Right answer is turn off Strict SSL.
好吧，这不是一个正确的答案，但可以被视为一种快速解决方法。正确答案是关闭严格 SSL。
I am having the same error
我有同样的错误
PhantomJS not found on PATH
Downloading https://github.com/Medium/phantomjs/releases/download/v2.1.1/phantomjs-2.1.1-windows.zip
Saving to C:\Users\Sam\AppData\Local\Temp\phantomjs\phantomjs-2.1.1-windows.zip
Receiving...
PhantomJS 在 PATH
下载中找不到https://github.com/Medium/phantomjs/releases/download/v2.1.1/phantomjs-2.1.1-windows.zip
保存到 C:\Users\Sam\AppData\Local\Temp\ phantomjs\phantomjs-2.1.1-windows.zip 正在
接收...
Error making request.
Error: unable to get local issuer certificate
at TLSSocket. (_tls_wrap.js:1105:38)
at emitNone (events.js:106:13)
at TLSSocket.emit (events.js:208:7)
at TLSSocket._finishInit (_tls_wrap.js:639:8)
at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:469:38)
提出请求时出错。
错误：无法
在 TLSSocket上获得本地颁发者证书。(_tls_wrap.js:1105:38)
at emitNone (events.js:106:13)
at TLSSocket.emit (events.js:208:7)
at TLSSocket._finishInit (_tls_wrap.js:639:8)
at TLSWrap.ssl .onhandshakedone (_tls_wrap.js:469:38)
So the after reading the error.
所以在阅读错误之后。
Just downloaded the file manually and placed it on the required path. i.e
只需手动下载文件并将其放置在所需的路径上。IE
C:\Users\Sam\AppData\Local\Temp\phantomjs\
This solved my problem.
这解决了我的问题。
PhantomJS not found on PATH
Download already available at C:\Users\sam\AppData\Local\Temp\phantomjs\phantomjs-2.1.1-windows.zip
Verified checksum of previously downloaded file
Extracting zip contents
回答by Willy David Jr
I have encountered the same issue. This command didn't work for me either:
我遇到了同样的问题。这个命令对我也不起作用：
npm config set strict-ssl false
After digging deeper, I found out that this link was block by our IT admin.
深入挖掘后，我发现此链接已被我们的 IT 管理员阻止。
http://registry.npmjs.org/npm
So if you are facing the same issue, make sure this link is accessible to your browser first.
因此，如果您遇到同样的问题，请先确保您的浏览器可以访问此链接。
