unable to get local issuer certificate | UNABLE_TO_GET_ISSUER_CERT_LOCALLY

[gojanpaolo]

Hello! I run WSL Ubuntu on an Azure Virtual Desktop (no VPN as far as I'm aware) and Copilot stopped working recently.

This is my :Copilot log.
I tried solutions online like https://stackoverflow.com/questions/45884752/npm-err-code-unable-to-get-issuer-cert-locally but none of them worked. How can I troubleshoot further? Thanks!

:Copilot log

[2025-09-01 16:27:08] [INFO] [lsp] GitHub Copilot Language Server 1.236.0 initialized
[2025-09-01 16:27:16] [INFO] [certificates] Removed 2 expired certificates
[2025-09-01 16:27:17] [ERROR] [ghostText] Error on ghost text request: FetchError: unable to get local issuer certificate
    at fetch (/home/jan/.local/share/nvim/lazy/copilot.vim/node_modules/@adobe/helix-fetch/src/fetch/index.js:99:11)
    at processTicksAndRejections (node:internal/process/task_queues:105:5)
    at cachingFetch (/home/jan/.local/share/nvim/lazy/copilot.vim/node_modules/@adobe/helix-fetch/src/fetch/index.js:288:16)
    at Dge.fetch (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/network/helix.ts:93:22)
    at bte.fetchWithParameters (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/openai/fetch.ts:450:26)
    at bte.fetchAndStreamCompletions (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/openai/fetch.ts:353:26)
    at genericGetCompletionsFromNetwork (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/ghostText/ghostText.ts:149:21)
    at getGhostText (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/ghostText/ghostText.ts:698:23)
    at getGhostTextWithAbortHandling (/home/jan/.local/share/nvim/lazy/copilot.vim/agent/src/methods/getCompletions.ts:313:16)
    at handleChecked (/home/jan/.local/share/nvim/lazy/copilot.vim/agent/src/methods/inlineCompletion.ts:86:33) {
  type: 'system',
  _name: 'FetchError',
  code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
  errno: undefined,
  erroredSysCall: undefined
}
[2025-09-01 16:27:17] [ERROR] [ghostText] Error on ghost text request: FetchError: unable to get local issuer certificate
    at fetch (/home/jan/.local/share/nvim/lazy/copilot.vim/node_modules/@adobe/helix-fetch/src/fetch/index.js:99:11)
    at processTicksAndRejections (node:internal/process/task_queues:105:5)
    at cachingFetch (/home/jan/.local/share/nvim/lazy/copilot.vim/node_modules/@adobe/helix-fetch/src/fetch/index.js:288:16)
    at Dge.fetch (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/network/helix.ts:93:22)
    at bte.fetchWithParameters (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/openai/fetch.ts:450:26)
    at bte.fetchAndStreamCompletions (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/openai/fetch.ts:353:26)
    at genericGetCompletionsFromNetwork (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/ghostText/ghostText.ts:149:21)
    at getGhostText (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/ghostText/ghostText.ts:698:23)
    at getGhostTextWithAbortHandling (/home/jan/.local/share/nvim/lazy/copilot.vim/agent/src/methods/getCompletions.ts:313:16)
    at handleChecked (/home/jan/.local/share/nvim/lazy/copilot.vim/agent/src/methods/inlineCompletion.ts:86:33) {
  type: 'system',
  _name: 'FetchError',
  code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
  errno: undefined,
  erroredSysCall: undefined
}
[2025-09-01 16:27:31] [ERROR] [default] Error sending telemetry FetchError: unable to get local issuer certificate
    at fetch (/home/jan/.local/share/nvim/lazy/copilot.vim/node_modules/@adobe/helix-fetch/src/fetch/index.js:99:11)
    at processTicksAndRejections (node:internal/process/task_queues:105:5)
    at cachingFetch (/home/jan/.local/share/nvim/lazy/copilot.vim/node_modules/@adobe/helix-fetch/src/fetch/index.js:288:16)
    at Dge.fetch (/home/jan/.local/share/nvim/lazy/copilot.vim/lib/src/network/helix.ts:93:22) {
  type: 'system',
  _name: 'FetchError',
  code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
  errno: undefined,
  erroredSysCall: undefined
}

Additional info:

:Copilot version
copilot.vim 1.41.0
Neovim 0.10.2
GitHub Copilot Language Server 1.236.0
Node.js 24.7.0
Linux

$ node -v
v24.7.0

$ nvim -v
NVIM v0.10.2
Build type: Release
LuaJIT 2.1.1713484068
Run "nvim -V1 -v" for more info

---

These are what I tried so far:

Restarted my terminal

Re-setup/enable Copilot

:Copilot signout
:Copilot setup

:Copilot disable
:Copilot enable

Re-installed ca-certificates

$ sudo apt-get update
Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease
Hit:2 http://archive.ubuntu.com/ubuntu noble-updates InRelease
Hit:3 http://archive.ubuntu.com/ubuntu noble-backports InRelease
Hit:4 https://download.docker.com/linux/ubuntu noble InRelease
Hit:5 http://security.ubuntu.com/ubuntu focal-security InRelease
Hit:6 http://security.ubuntu.com/ubuntu noble-security InRelease
Reading package lists... Done

$ sudo apt-get install --reinstall ca-certificates
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
  fonts-font-awesome gir1.2-atk-1.0 gir1.2-ayatanaappindicator3-0.1 gir1.2-freedesktop gir1.2-gdkpixbuf-2.0 gir1.2-gtk-3.0
  gir1.2-harfbuzz-0.0 gir1.2-pango-1.0 gnome-icon-theme libayatana-appindicator3-1 libayatana-ido3-0.4-0 libayatana-indicator3-7 libcares2
  libdbusmenu-glib4 libdbusmenu-gtk3-4 libglew2.2 libharfbuzz-gobject0 libluajit-5.1-2 libluajit-5.1-common libmsgpackc2 libpangoxft-1.0-0
  libslopy7.6 libtermkey1 libtree-sitter0 libunibilium4 libvterm0 lua-luv neovim-runtime node-busboy node-cjs-module-lexer node-undici
  node-xtend nodejs-doc python3-cairo python3-gi-cairo python3-greenlet python3-msgpack python3-pynvim slop xclip
Use 'sudo apt autoremove' to remove them.
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 135 not upgraded.
Need to get 159 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu noble/main amd64 ca-certificates all 20240203 [159 kB]
Fetched 159 kB in 1s (178 kB/s)
Preconfiguring packages ...
(Reading database ... 59986 files and directories currently installed.)
Preparing to unpack .../ca-certificates_20240203_all.deb ...
Unpacking ca-certificates (20240203) over (20240203) ...
Setting up ca-certificates (20240203) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Processing triggers for man-db (2.12.0-4build2) ...
Processing triggers for ca-certificates (20240203) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

$ sudo update-ca-certificates
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

Change npm config

$ npm config set registry http://registry.npmjs.org
$ npm config set registry https://registry.npmjs.org
$ npm config set strict-ssl=false
$ npm config set strict-ssl=true

Test `npm install`

$ cd $(mktemp -d)

$ npm init --yes
Wrote to /tmp/tmp.rTmLpSAjib/package.json:

{
  "name": "tmp.rtmlpsajib",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "type": "commonjs"
}

$ npm install --loglevel verbose
npm verbose cli /home/jan/.nvm/versions/node/v24.7.0/bin/node /home/jan/.nvm/versions/node/v24.7.0/bin/npm
npm info using npm@11.5.1
npm info using node@v24.7.0
npm verbose title npm install
npm verbose argv "install" "--loglevel" "verbose"
npm verbose logfile logs-max:10 dir:/home/jan/.npm/_logs/2025-09-01T16_37_31_939Z-
npm verbose logfile /home/jan/.npm/_logs/2025-09-01T16_37_31_939Z-debug-0.log

up to date, audited 1 package in 317ms

found 0 vulnerabilities
npm verbose cwd /tmp/tmp.rTmLpSAjib
npm verbose os Linux 6.6.87.2-microsoft-standard-WSL2
npm verbose node v24.7.0
npm verbose npm  v11.5.1
npm verbose exit 0
npm info ok

$ cat /home/jan/.npm/_logs/2025-09-01T16_37_31_939Z-debug-0.log
0 verbose cli /home/jan/.nvm/versions/node/v24.7.0/bin/node /home/jan/.nvm/versions/node/v24.7.0/bin/npm
1 info using npm@11.5.1
2 info using node@v24.7.0
3 silly config load:file:/home/jan/.nvm/versions/node/v24.7.0/lib/node_modules/npm/npmrc
4 silly config load:file:/tmp/tmp.rTmLpSAjib/.npmrc
5 silly config load:file:/home/jan/.npmrc
6 silly config load:file:/home/jan/.nvm/versions/node/v24.7.0/etc/npmrc
7 verbose title npm install
8 verbose argv "install" "--loglevel" "verbose"
9 verbose logfile logs-max:10 dir:/home/jan/.npm/_logs/2025-09-01T16_37_31_939Z-
10 verbose logfile /home/jan/.npm/_logs/2025-09-01T16_37_31_939Z-debug-0.log
11 silly logfile start cleaning logs, removing 1 files
12 silly packumentCache heap:2348810240 maxSize:587202560 maxEntrySize:293601280
13 silly logfile done cleaning log files
14 silly idealTree buildDeps
15 silly reify moves {}
16 silly audit report null
17 verbose cwd /tmp/tmp.rTmLpSAjib
18 verbose os Linux 6.6.87.2-microsoft-standard-WSL2
19 verbose node v24.7.0
20 verbose npm  v11.5.1
21 verbose exit 0
22 info ok

Installed supermaven and that works fine. I'd like to get Copilot working though because our company already have a subscription

[tanabarr]

+1

[tpope]

This is generally a proxy or firewall issue. You can use these commands to test if you machine itself can connect:

curl https://proxy.enterprise.githubcopilot.com/_ping
curl https://proxy.individual.githubcopilot.com/_ping

I tried solutions online like https://stackoverflow.com/questions/45884752/npm-err-code-unable-to-get-issuer-cert-locally but none of them worked.

This is mostly concerned with npm not being to connect, not relevant to this issue. But there is one workaround there that will work:

export NODE_TLS_REJECT_UNAUTHORIZED=0

This will disable all cert verification in Node.js, so use it with care.

[tanabarr]

My specific issue seems to be related to Zscaler.