Unable to get local issuer exception

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• What's the actual output vs expected output?

Description

I'm using @openapitools/openapi-generator-cli@2.0.3 to generate the code from the openapi spec.
Originally, my code worked with 1.0.18-4.3.1 and I was using the command line e.g.

yarn run openapi-generator generate -i /app/schema.json -g typescript-fetch -o /app/output -t /app/templates

After the migration to 2.x I had to modify the command line to

yarn run openapi-generator-cli generate -i /app/schema.json -g typescript-fetch -o /app/output -t /app/templates

and the output for this call is:

(node:48032) UnhandledPromiseRejectionWarning: Error: unable to get local issuer certificate
    at TLSSocket.onConnectSecure (_tls_wrap.js:1321:34)
    at TLSSocket.emit (events.js:223:5)
    at TLSSocket._finishInit (_tls_wrap.js:794:8)
    at TLSWrap.ssl.onhandshakedone (_tls_wrap.js:608:12)
(node:48032) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 2)
(node:48032) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

I'm behind the corporate firewall and I did not expect to have any calls made by the openapi generator. What are they for and can I turn them off?

openapi-generator version

2.0.3

Start by reproducing the openapi-generator-cli@2.0.3 command shown in the report, using the typescript-fetch generator and the supplied schema. Trace which network calls lead to the “unable to get local issuer certificate” error and determine whether they can be disabled. Done means documenting the calls and a working way to run generation behind the reported corporate firewall.