go auth_error ai_generated true

Get "https://internal.svc": tls: failed to verify certificate: x509: certificate signed by unknown authority

ID: go/http-tls-certificate-unknown-authority

Also available as: JSON · Markdown · 中文
80%Fix Rate
87%Confidence
0Evidence
2024-03-30First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
1.18 active — — —
1.21 active — — —

Root Cause

The server uses a private CA whose root is not in the system trust store, or the container lacks ca-certificates.

generic

中文

服务器使用私有 CA，其根证书不在系统信任库中，或容器缺少 ca-certificates。

Workarounds

  1. 90% success 
    pool, _ := x509.SystemCertPool()
pem, _ := os.ReadFile("/etc/ssl/private-ca.pem")
pool.AppendCertsFromPEM(pem)
tr := &http.Transport{TLSClientConfig: &tls.Config{RootCAs: pool}}
  2. 88% success 
    Install ca-certificates in the container image and mount the private CA into /usr/local/share/ca-certificates.

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Disables verification entirely, defeating TLS security in production.

  2. 85% fail

    Does not address the unknown authority issue.