Corporate proxy, self-signed root: fix Node's TLS once with NODE_EXTRA_CA_CERTS, not with rejectUnauthorized

verbatim errorError: unable to verify the first certificate at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34) code: 'SELF_SIGNED_CERT_IN_CHAIN'

Problem

Behind the corporate network, every HTTPS call from Node services and dev tools failed:

Error: unable to verify the first certificate
    at TLSSocket.onConnectSecure (node:_tls_wrap:1674:34)
code: 'SELF_SIGNED_CERT_IN_CHAIN'

curl worked (it uses the system trust store, which IT had already updated). Python worked. Node and anything bundling its own CA list (many CLIs, Electron apps, grpc) failed. The internet's fix — NODE_TLS_REJECT_UNAUTHORIZED=0 — was already in three CI files and two laptops before anyone stopped to look at it.

Root cause

The corporate TLS-inspecting proxy re-signs outbound traffic with a company root CA. Node ships its own compiled-in Mozilla CA bundle and ignores the OS trust store, so the company root is simply unknown to it. Every "random" failing tool had Node inside it.

NODE_TLS_REJECT_UNAUTHORIZED=0 disables verification entirely: any certificate, for any hostname, from any issuer, is accepted. It is not a workaround, it is an off switch — and one forgotten export turns a proxy problem into a permanent MITM exposure.

🔒 the fix — including 5 code blocks — is members-only. $1/mo unlocks everything.