Failed to get signing key: UNABLE_TO_GET_ISSUER_CERT_LOCALLY

[ArunkumarTMEYGDS]

Describe the bug
We created a sample Teams Agent app using M365 Agents Toolkit from template path
M365 Toolkit -> Create a New Agent/App -> Teams Agents and Apps -> General Teams Agent

We have Custom upload enabled with Copilot license. We have created a simple test Azure OpenAI Agent and used its key, end point and deployment name to create a sample solution to test it and it gave the below error while debugging in Teams in Egde and post a query to agent.

[ERROR] @teams/app/http/jwt-validation-middleware/jwt-validator

Failed to get signing key: {
"code": "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"
}

JWT verification failed: {
"name": "JsonWebTokenError",
"message": "error in secret or public key callback: unable to get local issuer certificate"
}

We tried installing certificate by following below blog and adding the commented code mentioned in m365agents.local.yml but still getting same error.

https://github.com/OfficeDev/microsoft-365-agents-toolkit/wiki/%7BDebug%7D-FAQ#what-to-do-if-i-do-not-want-to-install-the-development-certificate

To Reproduce
Steps to reproduce the behavior:

1. Install M365 Agents Tookit in VS Code
2. Create a simple test Azure OpenAI Agent
3. Create a sample template using M365 Toolkit -> Create a New Agent/App -> Teams Agents and Apps -> General Teams Agent
4. Provide Key, endpoint URL and deployment name.
5. Run the solution for debugging in Teams in Egde/Chrome

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots

VS Code Extension Information (please complete the following information):

• OS: Windows 11
• Version 23H2

CLI Information (please complete the following information):

• OS: Windows 11
• Version 23H2

Additional context
M365 Agents Toolkit version: 6.4.1
Node version: 18.17.1
VS Code Version: 1.106.1
Azure Open AI GPT Model: gpt-4o-mini

[m365-agent-toolkit-assistant]

👋 Hi @ArunkumarTMEYGDS,

Thank you for reporting this issue! We want to let you know that:

⏱️ Our team will personally review your issue
🎯 You can expect a response within 2 business days

✨ This is an AI-generated initial response
🤖 AI-Generated Preliminary Analysis:

Your error UNABLE_TO_GET_ISSUER_CERT_LOCALLY is a known SSL certificate validation issue—often triggered when running Microsoft 365 Agents Toolkit (or playground) behind a proxy or missing trusted root CA in your local dev environment.

Key Causes & Solutions:

1. Corporate Proxy / SSL:
   This issue is typical behind corporate proxies with custom SSL interception. Your Node.js process or agent app can't trust the root issuer for Microsoft's endpoints.

2. Workarounds:

   • Import your organization's root CA: Import your proxy/CA certificate into the Windows trusted root store.
   • Set NODE_EXTRA_CA_CERTS: Point this env variable to your root CA (e.g., set NODE_EXTRA_CA_CERTS=C:\path\to\your\corp.pem).
   • Try running in admin mode: Sometimes admin rights are required to use trusted certs.
   • Node.js Settings: If you must bypass for local dev, set NODE_TLS_REJECT_UNAUTHORIZED=0 (not for production).

3. Relevant Discussions & Fixes:

   • Issue #14009
   • StackOverflow: Add-ins cert error

Action:
Try importing your proxy/corporate CA to your OS and set NODE_EXTRA_CA_CERTS in your dev shell before starting VS Code/debugging the agent. This resolves certificate errors for most toolkit users.

Let me know if you'd like exact steps for importing a certificate or setting those environment variables.

✨We'd love your feedback! Please take a moment to fill out our survey.

---

Note: This is an automated first response generated by AI. A human team member will review your issue and provide a more detailed response soon. We appreciate your patience!

[ArunkumarTMEYGDS]

Please provide the step by step on Workaround mentioned above like how can I import your organization's root CA

[qinzhouxu]

Please provide the step by step on Workaround mentioned above like how can I import your organization's root CA

Hi @ArunkumarTMEYGDS , please try either the following methods:

1. Add NODE_TLS_REJECT_UNAUTHORIZED=0 to .localConfigs file, which disable all TLS certificate verification. This should be a workaround and please only use it in dev environment.
2. Check the SSL_CRT_FILE and SSL_KEY_FILE value in your .localConfigs file, manually delete the corresponding certs and debug again. If you do not comment the step like you mentioned, there should be a pop up and you may select install, and then see whether it works.