go auth_error ai_generated true

Get "https://internal.svc"：tls：证书验证失败：x509：证书由未知机构签发

Get "https://internal.svc": tls: failed to verify certificate: x509: certificate signed by unknown authority

ID: go/http-tls-certificate-unknown-authority

其他格式: JSON · Markdown 中文 · English
80%修复率
87%置信度
0证据数
2024-03-30首次发现

版本兼容性

版本状态引入弃用备注
1.18 active — — —
1.21 active — — —

根因分析

服务器使用私有 CA，其根证书不在系统信任库中，或容器缺少 ca-certificates。

English

The server uses a private CA whose root is not in the system trust store, or the container lacks ca-certificates.

generic

解决方案

  1. 90% 成功率 
    pool, _ := x509.SystemCertPool()
pem, _ := os.ReadFile("/etc/ssl/private-ca.pem")
pool.AppendCertsFromPEM(pem)
tr := &http.Transport{TLSClientConfig: &tls.Config{RootCAs: pool}}
  2. 88% 成功率 
    Install ca-certificates in the container image and mount the private CA into /usr/local/share/ca-certificates.

无效尝试

常见但无效的做法:

  1. 90% 失败

    Disables verification entirely, defeating TLS security in production.

  2. 85% 失败

    Does not address the unknown authority issue.