# Get "https://internal.svc": tls: failed to verify certificate: x509: certificate signed by unknown authority

- **ID:** `go/http-tls-certificate-unknown-authority`
- **Domain:** go
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The server uses a private CA whose root is not in the system trust store, or the container lacks ca-certificates.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 1.18 | active | — | — |
| 1.21 | active | — | — |

## Workarounds

1. **** (90% success)
   ```
   pool, _ := x509.SystemCertPool()
pem, _ := os.ReadFile("/etc/ssl/private-ca.pem")
pool.AppendCertsFromPEM(pem)
tr := &http.Transport{TLSClientConfig: &tls.Config{RootCAs: pool}}
   ```
2. **** (88% success)
   ```
   Install ca-certificates in the container image and mount the private CA into /usr/local/share/ca-certificates.
   ```

## Dead Ends

- **** — Disables verification entirely, defeating TLS security in production. (90% fail)
- **** — Does not address the unknown authority issue. (85% fail)