gatsbyjs/gatsby · error

111002

111002

Error message

We couldn't make a secure connection to your contentful space. Please check if you have any self-signed SSL certificates installed.

What it means

Branch of the central error dispatcher handleContentfulError: a Contentful SDK request failed with Node error code SELF_SIGNED_CERT_IN_CHAIN, meaning the TLS certificate chain for cdn.contentful.com could not be verified because a self-signed certificate (typically a corporate proxy/MITM firewall that re-signs traffic) interrupts the chain. The dispatcher translates raw network error codes into user-facing panics; this branch indicates the local trust store lacks the proxy's root CA.

Source

Thrown at packages/gatsby-source-contentful/src/fetch.js:171

    // Allow passing of custom configuration to the Contentful SDK like headers
    ...(pluginConfig.get(`contentfulClientConfig`) || {}),
  }

  return contentfulClientOptions
}

function handleContentfulError({
  e,
  reporter,
  contentfulClientOptions,
  pluginConfig,
}) {
  let details
  let errors
  if (e.code === `ENOTFOUND`) {
    details = `You seem to be offline`
  } else if (e.code === `SELF_SIGNED_CERT_IN_CHAIN`) {
    reporter.panic({
      id: CODES.SelfSignedCertificate,
      context: {
        sourceMessage: `We couldn't make a secure connection to your contentful space. Please check if you have any self-signed SSL certificates installed.`,
      },
    })
  } else if (e.responseData) {
    if (
      e.responseData.status === 404 &&
      contentfulClientOptions.environment &&
      contentfulClientOptions.environment !== `master`
    ) {
      // environments need to have access to master
      details = `Unable to access your space. Check if ${chalk.yellow(
        `environment`
      )} is correct and your ${chalk.yellow(
        `accessToken`
      )} has access to the ${chalk.yellow(
        contentfulClientOptions.environment

View on GitHub (pinned to e85d62f177)

Solutions

1. Export the proxy/firewall's root CA certificate and add it to Node's trusted certificates, e.g. set NODE_EXTRA_CA_CERTS=/path/to/corporate-root-ca.pem in the build environment
2. Configure axios/the Contentful SDK to use a custom https.Agent whose ca option includes the proxy's certificate
3. If behind a corporate proxy, configure it to pass through *.contentful.com without TLS interception, or route the build outside the proxy
4. Temporarily verify the diagnosis by running the build on a network without TLS interception

When it happens

Trigger: Thrown at packages/gatsby-source-contentful/src/fetch.js:171 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of gatsbyjs/gatsby@e85d62f177 (2026-08-26). Data as JSON: /api/errors/4f8e57aeca5db3e0. Report an issue: GitHub.