Gemini CLI error
Gemini CLI: UNABLE_TO_GET_ISSUER_CERT_LOCALLY or unable to get local issuer...
UNABLE_TO_GET_ISSUER_CERT_LOCALLY or unable to get local issuer certificateStatus: WorkaroundLast verified 2 documented fixes1 source
What it means
Node.js could not verify the TLS certificate chain of Google's endpoints, so sign-in or API requests fail.
Causes
- You may be on a corporate network with a firewall that intercepts and inspects SSL/TLS traffic, which often requires a custom root CA certificate to be trusted by Node.js (official troubleshooting guide).
How to fix it
- Fix 1.
First set NODE_USE_SYSTEM_CA=1 so Node.js uses the operating system's native certificate store, where corporate certificates are typically already installed. Windows PowerShell: $env:NODE_USE_SYSTEM_CA=1
Terminalexport NODE_USE_SYSTEM_CA=1 - Fix 2.
If that does not resolve it, set NODE_EXTRA_CA_CERTS to the absolute path of your corporate root CA certificate file. Windows PowerShell: $env:NODE_EXTRA_CA_CERTS="C:\path\to\your\corporate-ca.crt"
Terminalexport NODE_EXTRA_CA_CERTS=/path/to/your/corporate-ca.crt
More Gemini CLI errors
All 19 Gemini CLI errorsYou must be a named user on your organization's Gemini Code Assist Standard edition subscription to use this service. Please contact your administrator to request an entitlement to Gemini Code Assist Standard edition.Status: WorkaroundFailed to sign in. Message: Your current account is not eligible... because it is not currently available in your location.Status: By designFailed to sign in. Message: Request contains an invalid argumentStatus: WorkaroundThis account requires setting the GOOGLE_CLOUD_PROJECT or GOOGLE_CLOUD_PROJECT_ID env var. See https://geminicli.com/docs/get-started/authentication/#set-gcpStatus: By designInvalid Google Cloud Project ID: "<projectId>". The GOOGLE_CLOUD_PROJECT (or GOOGLE_CLOUD_PROJECT_ID) environment variable must be set to your string-based Project ID (e.g., "my-project-123"), not your numeric Project Number. Please update your environment variables.Status: By designFailed to login. Message: Precondition check failed.Status: Fixed in releaseYou are currently configured to use a Google Cloud Project but lack a Gemini Code Assist license. Please contact your administrator to request a license.Status: WorkaroundFailed to sign in. Message: You do not have a valid license of this product. Please contact your administrator to request a license. If you are not an enterprise user and believe you are receiving this message as an error, please try using the latest version and logging in again.Status: Open
Related reading
- Do Your Agent Hooks Fail Open? Claude Code vs Codex vs Cursor vs Gemini CLIA guard hook that crashes, times out or points at a missing script lets the tool call through by default in Claude Code. v2.1.295 adds onFailure: block. Here is what each coding agent does when your policy hook breaks, with real test runs.
- How to Keep API Keys Away From Your AI Coding Agent: Claude Code vs Codex vs Cursor vs Gemini CLIA deny rule on .env stops cat but not a Python one-liner. Here are the three layers that actually keep secrets out of a coding agent's context - file rules, environment scrubbing and credential masking - and what Claude Code, Codex, Cursor and Gemini CLI give you for each, with real test runs.
- Headless AI Coding Agents in CI: Claude Code, Codex CLI, Gemini CLI, and opencode ComparedHeadless AI coding agents in CI compared: Claude Code, Codex CLI, Gemini CLI, and opencode on invocation flags, sandboxing, auth, and output formats.
- Gemini CLI to Antigravity CLI Migration Guide: The June 18 DeadlineGemini CLI to Antigravity CLI migration guide: install, migrate config, update scripts and CI, and avoid the silent MCP failure that breaks tool calls.
- Gemini CLI Guide: 1M Token Context and Who Can Still Use ItGemini CLI puts a 1 million token context in your terminal but now only serves paid Gemini API, Vertex AI and Code Assist users. Setup and TypeScript workflow.
FAQ
What does "UNABLE_TO_GET_ISSUER_CERT_LOCALLY or unable to get local issuer..." mean in Gemini CLI?
Node.js could not verify the TLS certificate chain of Google's endpoints, so sign-in or API requests fail.
How do I fix "UNABLE_TO_GET_ISSUER_CERT_LOCALLY or unable to get local issuer..."?
There are 2 documented fixes. Start with the first: First set NODE_USE_SYSTEM_CA=1 so Node.js uses the operating system's native certificate store, where corporate certificates are typically already installed. Windows PowerShell: $env:NODE_USE_SYSTEM_CA=1
Is this Gemini CLI error fixed?
Status: Workaround. No release removes the cause. The documented fixes work around it.
Sources
Last verified against 1 source: official docs, maintainer replies and release notes.
Newsletter
Fixes for the tools you use, weekly
One email per week. New coding agent releases, what broke, and how developers are working around it.