n8n-io/n8n · error · NodeSslError

SSL Issue: consider using the 'Ignore SSL issues' option

Error message

SSL Issue: consider using the 'Ignore SSL issues' option

What it means

NodeSslError thrown in the legacy request error handler when the request was made with rejectUnauthorized set and the underlying error.code includes 'CERT'. NodeSslError (from n8n-workflow) carries the fixed user-facing message 'SSL Issue: consider using the 'Ignore SSL issues' option'. It signals a TLS certificate validation failure on the node's outbound HTTP request.

Source

Thrown at packages/@n8n/backend-network/src/http/legacy-request.ts:149

				}

				error.message = `${response.status as number} - ${JSON.stringify(responseData)}`;
				throw Object.assign(error, {
					statusCode: response.status,
					/**
					 * Axios adds `status` when serializing, causing `status` to be available only to the client.
					 * Hence we add it explicitly to allow the backend to use it when resolving expressions.
					 */
					status: response.status,
					error: responseData,
					response: {
						headers: response.headers,
						status: response.status,
						statusText: response.statusText,
					},
				});
			} else if ('rejectUnauthorized' in requestObject && error.code?.includes('CERT')) {
				throw new NodeSslError(error);
			}
		}

		throw error;
	}
}

View on GitHub (pinned to 5ac6606e81)

Solutions

Enable the node's 'Ignore SSL Issues' option (or set rejectUnauthorized:false where appropriate).
Import the signing CA into the host trust store (NODE_EXTRA_CA_CERTS) for a permanent fix.
Renew the expired certificate on the target server.
Fix host clock skew if the cert appears expired due to time drift.

Example fix

// before
const res = await this.helpers.httpRequest({ url, json: true });

// after - accept the self-signed cert for this node
const res = await this.helpers.httpRequest({
  url,
  json: true,
  skipSslVerification: true,
});

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-validate the URL scheme/host before sending, and decide skipSsl policy
const isInternalCa = (host: string) => /\.corp\.|\.internal$/.test(host);
const skipSsl = isInternalCa(new URL(url).host);

Type guard

import { NodeSslError } from 'n8n-workflow';
const isNodeSslError = (e: unknown): boolean => e instanceof NodeSslError;

Try / catch

try {
  await this.helpers.httpRequest({ url, json: true });
} catch (e) {
  if (e instanceof NodeSslError) {
    // prompt user to enable 'Ignore SSL issues' or install the CA
    await this.helpers.httpRequest({ url, json: true, skipSslVerification: true });
  } else {
    throw e;
  }
}

Prevention

Import internal CAs via NODE_EXTRA_CA_CERTS instead of disabling verification.
Renew expiring certificates before they break node executions.
Use skipSslVerification only for trusted internal endpoints, never for public ones.

When it happens

Trigger: A node HTTP request fails with an error whose code contains 'CERT' (e.g. UNABLE_TO_VERIFY_LEAF_SIGNATURE, CERT_HAS_EXPIRED, SELF_SIGNED_CERT_IN_CHAIN) and requestObject.rejectUnauthorized was set. The branch at line 148 converts it to NodeSslError so the UI can prompt the user to enable 'Ignore SSL issues'.

Common situations: Target server uses a self-signed or internal-CA certificate; a corporate proxy performs TLS interception with an untrusted CA; an expired certificate on the target; a development endpoint without a valid cert; clock skew making a valid cert appear expired.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/2f6df93c2c3ceb18. Report an issue: GitHub.