# Nodemailer “self-signed certificate in certificate chain”

Four certificate errors Nodemailer shows, reproduced with test SMTP servers: what each means and how to trust the right root instead of turning checks off.

Author: Formgong
Published: 2026-10-16
Language: en
Canonical: https://formgong.com/en/blog/nodemailer-self-signed-certificate/

self-signed certificate in certificate chain means the server sent a certificate chain that ends in a root Node does not trust, often a company proxy or antivirus that inspects mail traffic, or a private mail server. Add that root with tls.ca or NODE_EXTRA_CA_CERTS. rejectUnauthorized: false makes the error go away but also stops Node from checking who it talks to.

## Which setup gives which message

*Figure: A contact form shows an error after Send. The terminal shows Nodemailer's self-signed certificate in certificate chain error with code ESOCKET.*

On 16.10.2026 we ran local SMTP servers with certificates made by openssl and connected Node.js 22.23 and nodemailer 10.1.1 to each. Every failure had `code: "ESOCKET"` and `command: "CONN"`; only the message changed:

Certificate errors in Nodemailer
What the server sentMessage

One certificate that signs itself`self-signed certificate`
Its certificate plus the private root that signed it`self-signed certificate in certificate chain`
Its certificate only, signed by a root Node has never seen`unable to verify the first certificate`
A valid certificate, but you connected by IP address`Hostname/IP does not match certificate's altnames`

The STARTTLS case on port 587 gave the same `self-signed certificate` message as port 465. The last row we reproduced with Node's TLS client against one of Gmail's IP addresses: the certificate was valid, just not for a bare IP.

## Where an unknown root comes from

- **Antivirus or a company proxy.** Some security tools scan mail by decrypting it and re-signing it with their own root. Your browser trusts that root because the tool installed it in the system; Node uses its own list and does not. That is why the error can appear on one machine and not on another.

- **A private mail server** with a self-made certificate, common on internal Exchange or Postfix boxes.

- **A local test server** such as MailHog or a Docker mail container.

- **The host name in your config** is an IP or an internal alias that the certificate does not list.

## Trust the root instead of turning checks off

Get the root certificate from whoever runs the proxy or server, as a PEM file. Give it to one transport with `tls.ca`, or to the whole process with `NODE_EXTRA_CA_CERTS`. Both fixes worked on our test; the connection that failed with “self-signed certificate in certificate chain” then sent.

`tls: { rejectUnauthorized: false }` also made every case send. It is fine on a test server on your own laptop. On a real server it means anyone between you and the mail server can read the SMTP password. For the IP case, use the host name the certificate was issued for, or set `tls.servername` to it.

```javascript
import fs from "node:fs";

// Trust one extra root certificate for this transport only
const transporter = nodemailer.createTransport({
  host: "mail.yourcompany.local",
  port: 465,
  secure: true,
  tls: { ca: [fs.readFileSync("./company-root-ca.pem")] },
  auth,
});

// Or for the whole Node process, without code changes:
// NODE_EXTRA_CA_CERTS=./company-root-ca.pem node server.js
```

## Do you need an SMTP connection for a contact form?

If the SMTP login exists only so a contact form can email you, you can drop it: a form that posts to [Formgong](/en/) at `https://formgong.com/submit` has no SMTP host, port or password in your code, and Formgong sends the notification itself. See the [HTML guide](/en/docs/html/).

## Frequently asked questions

### What does self-signed certificate in certificate chain mean?

The server's certificate chain ends in a root that Node does not trust. Common sources are antivirus or proxy tools that inspect mail, and private mail servers.

### Is rejectUnauthorized: false safe?

Only on a test server you control. It stops Node from checking the server's identity, so the SMTP password could be read by anyone in the middle.

### Why does my browser trust the site but Nodemailer does not?

Node ships its own list of root certificates and does not read roots that a tool added to your system. Add the root with tls.ca or NODE_EXTRA_CA_CERTS.

### What does unable to verify the first certificate mean?

The server sent only its own certificate, not the intermediate or root that signed it, and Node could not build the chain. The server should send the full chain.

## Sources and documentation

- [Node.js: NODE_EXTRA_CA_CERTS](https://nodejs.org/api/cli.html#node_extra_ca_certsfile)
- [Node.js: tls.connect options (ca, servername, rejectUnauthorized)](https://nodejs.org/api/tls.html#tlsconnectoptions-callback)
- [Nodemailer: SMTP transport (tls options)](https://nodemailer.com/smtp/)
- [HTML contact form](https://formgong.com/en/docs/html/)

[Get a form key](https://formgong.com/en/#top)