We're migrating to using ZScaler which is currently configured to introspect TLS traffic to graphite domains. The graphite CLI fails with an underlying error of

unable to get local issuer certificate

in the

--debug

output. Basically it appears that we need something like this to be called within the graphite CLI, but I'm not able to see this option anywhere. Is this possible to setup?

const tls = require('node:tls');
tls.setDefaultCACertificates(tls.getCACertificates('system'));

(If applicable) To help us more clearly understand what you're trying to do, please provide additional details about: - Screenshots / debug logs / list of commands you've tried to run so far - Your workflow - Current state

Here's the relevant output of

gt sync --debug

(de-identified):

{"cliVersion":"1.7.6","level":"debug","message":"Requesting: {\n  \"apiServer\": \"<https://api.graphite.dev/v1>\",\n  \"route\": {\n    \"method\": \"POST\",\n    \"url\": \"/graphite/cli/pull-request-info\",\n    \"params\": {},\n    \"response\": {}\n  },\n  \"params\": {\n    \"repoOwner\": \"EXAMPLEORG\",\n    \"repoName\": \"EXAMPLEOWNER\",\n    \"prNumbers\": [],\n    \"prHeadRefNames\": [],\n    \"trunkBranchNames\": [\n      \"main\"\n    ],\n    \"consistent\": true,\n    \"callsite\": \"newSyncAction\"\n  }\n}","timestamp":"2025-11-11T23:00:28.578Z"}
{"cliVersion":"1.7.6","level":"debug","message":"Request failed: {\n  \"errorMessage\": \"fetch failed\",\n  \"errorCause\": \"unable to get local issuer certificate\"\n}","timestamp":"2025-11-11T23:00:28.759Z"}
{"cliVersion":"1.7.6","level":"debug","message":"Pinging 8.8.8.8 result was a success","timestamp":"2025-11-11T23:00:29.796Z"}
{"cliVersion":"1.7.6","level":"debug","message":"In-memory cache was not mutated; skipping persistence","timestamp":"2025-11-11T23:00:29.798Z"}
{"cliVersion":"1.7.6","level":"error","message":"\u001b[91mERROR: Could not connect to the Graphite server. Please try again. \u001b[39m","timestamp":"2025-11-11T23:00:29.799Z"}
ERROR: Could not connect to the Graphite server. Please try again. 
{"cliVersion":"1.7.6","level":"error","message":"\u001b[91mERROR: \u001b[31mFailed to fetch Graphite status information\u001b[39m\u001b[91m \u001b[39m","timestamp":"2025-11-11T23:00:29.956Z"}
ERROR: Failed to fetch Graphite status information 
{"cliVersion":"1.7.6","level":"error","message":"\u001b[91mERROR: \u001b[31mfetch failed\u001b[39m\u001b[91m \u001b[39m","timestamp":"2025-11-11T23:00:29.957Z"}
ERROR: fetch failed 
{"cliVersion":"1.7.6","level":"debug","message":"Connection: Could not connect to the Graphite server. Please try again.\n    at /snapshot/dist/graphite.js\n    at Generator.throw (<anonymous>)\n    at s (/snapshot/dist/graphite.js)\n    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)","timestamp":"2025-11-11T23:00:29.958Z"}

hey Aaron, you can run

export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt

. Adding that to your `.zsh`/`bashrc` will prevent needing to run it every time a new terminal session is started.

I'd like to avoid having to export certificates on everyone's machine, is there a way to have it use the system CA store directly? This is on macos.

ls /etc/ssl/certs/ca-certificates.crt
ls: /etc/ssl/certs/ca-certificates.crt: No such file or directory