Node ignores the corporate root certificate that the browser on the same laptop trusts

The pairing is what you diagnose on. If the site loads in a browser on the customer's machine while your process throws a certificate verification error on that same host, the network is delivering bytes and the fault is which trust store your code consults ^[15].

Python code using `requests`, or anything else built on `certifi`, reads the certifi bundle instead of the system store, and `REQUESTS_CA_BUNDLE` or `SSL_CERT_FILE` overrides it ^[12]. Java keeps `cacerts`, managed with `keytool`, entirely separate from the OS ^[13]. Go does read system roots on Linux and macOS, though code that sets a custom `tls.Config` with its own `RootCAs` pool has opted out of them ^[14]. Of the four runtimes the post lists, three ignore the operating system store by default ^[1]. One root installed by the customer's administrator therefore fixes the browser and leaves each of those to be configured on its own.

Certificate Transparency requirements and most key-pinning checks are enforced for publicly trusted CAs and, by design, relaxed for locally added ones, because if they were not, corporate inspection would break the web for a large fraction of enterprise users ^[9]. Nothing is being exploited here: the chain validates because an administrator installed the root ^[8]. The proxy mints a certificate on the fly for whatever site was asked for, signed by that CA ^[6], so the padlock the customer screenshots is real, and it belongs to their employer ^[7]. It is also why they will tell you their internet is working ^[10].

According to the post, large organisations are often legally required to inspect traffic leaving their network, and have been doing it for twenty years ^[3]. The post sets out five failure modes and works through two of them, the trust store mismatch and certificate pinning, before its text ends ^[20].

You cannot fix pinning from the client. An app that pins a certificate or public key, common in mobile apps and in anything handling payments, has said it will accept one identity whatever the trust store contains, and an inspection proxy cannot present it because it does not hold the private key ^[17]. Installing more certificates changes nothing, and pinning is meant to be unfixable from the client side ^[18]. The remedy is administrative: the post argues that if you pin, you need a documented way for administrators to allow-list your domain from inspection, and your error message should say so. Most apps that pin fail with a generic network error ^[19].