UNABLE_TO_VERIFY_LEAF_SIGNATURE during pnpm tarball downloads with strict-ssl disabled and custom ca configured

Corporate networks that intercept TLS often require pnpm to trust a custom certificate authority while also disabling strict SSL validation. In these environments, pnpm install can fail with UNABLE_TO_VERIFY_LEAF_SIGNATURE even after both strict-ssl=false and a custom ca or cafile are configured. The uncertainty is that pnpm's fetcher appears to apply these settings inconsistently: some requests—such as registry metadata lookups—may bypass validation, while tarball downloads still attempt to verify against the custom CA and fail.

pnpm v8+ exposes @pnpm/network.ca-file for loading CA bundles, but its interaction with NODE_EXTRA_CA_CERTS and the precedence between strict-ssl and explicit CA configuration remain unclear. Because the behavior is version-dependent, it is difficult to predict which request types will honor the disabled validation flag.

Does strict-ssl=false apply globally to all registry requests, or only to the initial metadata fetch? Is the cafile setting expected to override the system trust store for tarball downloads when strict SSL is disabled? How does NODE_EXTRA_CA_CERTS interact with pnpm's internal fetchers compared to explicit cafile configuration?