Error: DynamoDB Network Error: self signed certificate in chain

The TLS client cannot build a trusted certificate chain. A corporate HTTPS inspection proxy or an incomplete certificate bundle can cause this before DynamoDB receives the request.

1. Check the endpoint hostname, proxy configuration and system clock.
2. Obtain the approved CA certificate bundle from your organization and verify its source.
3. For Node.js, set NODE_EXTRA_CA_CERTS=/absolute/path/company-ca.pem before starting the process, then restart it. This extends the normal trusted roots. If an HTTPS agent sets an explicit ca option, configure that agent's CA bundle instead.
4. For the AWS CLI, configure its trusted bundle with AWS_CA_BUNDLE or --ca-bundle.

Keep HTTPS and certificate verification enabled. Setting NODE_TLS_REJECT_UNAUTHORIZED=0 or disabling SSL removes the verification that protects the connection; it does not repair the trust chain.

See Node.js extra CA certificates and AWS CLI environment configuration.