TL;DR
- Create a custom CA certificate file (in this example c:\temp\combo.ca.cer) containing BASE64-encoded DERs of all certs your corporate network security solution is presenting to Node.js when Node.js makes HTTPS requests
- set NODE_EXTRA_CA_CERTS=c:\temp\combo.ca.cer
- corepack enable
- yarn set version stable
Root Cause Analysis
I had the "Internal Error: Error when performing the request" at "corepack.js:3937:20" like everyone who's been here so I looked in line 3937 and discovered it was a vanilla https.get call. I stuck in some extra debugging into corepack.js to see what was being accessed and discovered it was failing trying to reach "https://registry.npmjs.com/pnpm".
I navigated to "https://registry.npmjs.com/pnpm" in my web browser and discovered my corporate environment let it load up with no errors. So I fired up Node JS and issued to see what would happen:
https.get("https://registry.npmjs.com/pnpm", {}, res => console.log(res));
I received a "unable to get local issuer certificate" error. In my corporate environment, there's a security solution that injects it's own self-signed certificates into responses from any outbound https requests. What that means for me is that I need to instruct anything issuing https requests (eg Node.js and curl) to use a custom CA certificate file.
To get corepack to work, I first hard-coded a custom CA certificate file into corepack.js and while it's pretty ugly, it did work. A bit of further digging around I found the NODE_EXTRA_CA_CERTS environment variable option used by Node.js so also tried the following in a Administrator-privileged cmd session with success (also removing the corepack.js hack I made earlier):
set NODE_EXTRA_CA_CERTS=c:\temp\combo.ca.cer
corepack enable
yarn set version stable
The combo.ca.cer was constructed by navigating to https://registry.npmjs.com/pnpm and exporting all the CA certs (root and any intermediate CA certs) to text files and copy-pasting the contents of all the CA cert files into a single text file called combo.ca.cer. I used advice from https://stackoverflow.com/a/44726189 to create my custom CA cert file.