NODE_TLS_REJECT_UNAUTHORIZED=0 does not affect the Railway CLI's HTTPS client. The current Railway CLI is a native Rust program, not a Node.js request, and it is built to use native operating-system root certificates. The error therefore means the Zscaler root CA is not trusted by the certificate store that this CLI process is reading.

Do not disable certificate verification. Install only the genuine Zscaler root certificate supplied by your organization's IT team into Windows' Trusted Root Certification Authorities store.

For a per-user installation, an administrator-approved certificate can be imported with PowerShell:

Import-Certificate `
  -FilePath 'C:\path\to\ZscalerRootCA.cer' `
  -CertStoreLocation 'Cert:\CurrentUser\Root'

Then close every terminal, open a new one, and verify the TLS path before logging in:

Get-Command railway -All
railway --version
curl.exe -I https://backboard.railway.com/graphql/v2
railway login --browserless

The curl.exe request may return a non-200 HTTP status because it is not a GraphQL POST; the important result is that TLS completes without UnknownIssuer.

The official Railway CLI repository shows that the CLI uses rustls-tls-native-roots, and documents browserless login:

• https://github.com/railwayapp/cli/blob/master/Cargo.toml
• https://github.com/railwayapp/cli#authentication

If you are actually running the command inside WSL, importing the CA into Windows is not enough. WSL has its own trust store; copy the IT-provided CA into /usr/local/share/ca-certificates/ and run sudo update-ca-certificates, then retry from a new WSL shell.

If the OS trust store contains the CA and the error remains, ask IT whether Zscaler is sending the complete root/intermediate chain for backboard.railway.com. Do not post the company certificate chain, Railway token, pairing code, or account details in this public thread.