DocumentationExperience Cloud KCS

Adobe I/O CLI TypeError when running ‘cloudmanagerselect’ on Windows due to certificate trust issues

Last update: July 30, 2026

This article explains how to resolve a TypeError encountered when running the Adobe I/O CLI cloudmanager:org:select command on Windows, which is caused by certificate trust configuration issues related to Node.js and network security solutions.

Description description

Environment

  • Adobe Experience Manager Cloud Manager via Adobe I/O CLI (aio)
  • Node.js v24.14.1
  • Windows OS

Issue/Symptoms

When running the command aio cloudmanager:org:select, the following error occurs:

TypeError: Cannot read properties of null (reading 'headers')
at ...HttpExponentialBackoff.js:142:35
...
Node.js v24.14.1
  • The error is observed in environments using network security solutions such as VPN or SSL inspection.
  • The issue is related to Node.js certificate validation because it does not trust the corporate root CA by default.

Cause

The error occurs because Node.js does not trust the corporate root CA used by the network security solution. As a result, certificate validation fails and the CLI networking library receives a null response object.

Resolution resolution

To fix the TypeError encountered when running the Adobe I/O CLI cloudmanager:org:select command on Windows, follow these steps:

  1. As a diagnostic test (not a permanent fix), temporarily disable TLS certificate validation to confirm the root cause:

    • Set the environment variable: set NODE_TLS_REJECT_UNAUTHORIZED=0
    • Run: aio cloudmanager:org:select
    • If the command succeeds, this confirms that Node.js is rejecting the certificate chain. Do not leave this setting enabled, as it disables all TLS validation and poses a security risk.

  2. For a permanent solution, export the corporate or network security appliance root CA certificate from Windows:

    • Open certmgr.msc.
    • Navigate to Trusted Root Certification Authorities.
    • Locate the relevant root certificate and export it as a Base-64 encoded .pem file.

  3. Configure Node.js to trust this certificate:

    • Set the environment variable: set NODE_EXTRA_CA_CERTS=C:\path\to\corporate-root-ca.pem
    • Run: aio cloudmanager:org:select
    • This allows Node.js to trust the corporate CA in addition to its default list, without disabling validation.

  4. Alternatively, if your Node.js version supports it, use the system CA store:

    • Set the environment variable: set NODE_OPTIONS=--use-system-ca
    • Run: aio cloudmanager:org:select
recommendation-more-help
experience-cloud-kcs-help-kbarticles