UNABLE_TO_GET_ISSUER_CERT_LOCALLY

[felixhummel]

Describe the bug
The inspector cannot connect to self-signed certificates.

To Reproduce
Steps to reproduce the behavior:

1. run a webserver with a self-signed cert (e.g. caddy in development with TLS enabled)

Expected behavior
Can connect without error.

Logs

  [cause]: Error: unable to get local issuer certificate
      at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
      at TLSSocket.emit (node:events:507:28)
      at TLSSocket._finishInit (node:_tls_wrap:1078:8)
      at ssl.onhandshakedone (node:_tls_wrap:864:12) {
    code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
  }

Additional context
The inspector could use the system trust store.

[cliffhall]

Hi @felixhummel!

I need some more context to troubleshoot this locally.

1. Where is the error you posted coming from? (Browser console, Inspector proxy terminal, Caddy terminal)
2. Can you show me your Caddyfile?
3. Are you using it to reverse proxy to a locally running express app?
4. If not, what does the actual server you're trying to run look like? How can I reproduce it in small world scale?

[SamMousa]

I have the same issue. I have a local MCP server running behind a server that uses a certificate signed by my own CA.
Fwiw, the system (linux) has been configured to trust the CA, so things like curl work.

Edit: I resolved it using a workaround
export NODE_EXTRA_CA_CERTS="/etc/ssl/certs/ca-certificates.crt"

[cliffhall]

export NODE_EXTRA_CA_CERTS="/etc/ssl/certs/ca-certificates.crt"

@felixhummel will this work for you?

[fractoholic]

Running my local mcp server written in nodejs, on windows, on a company machine... Had to set NODE_EXTRA_CA_CERTS in order to get things working.

[cliffhall]

Closing this one since there has been no response for a month, and there is a solution posted with an independent confirmation. Feel free to reopen if it doesn't work or you have more information, @felixhummel.

[felixhummel]

@cliffhall Thank you! Sorry for not responding - this totally slipped my mind. Best!

[chandruscm]

For anyone getting this error or UNABLE_TO_VERIFY_LEAF_SIGNATURE on a mac, what worked for me was setting NODE_EXTRA_CA_CERTS to the path of the root certificate authority that issued the self-signed certificate.

In the case of mkcert, you can do:
export NODE_EXTRA_CA_CERTS="$(mkcert -CAROOT)/rootCA.pem"