# Get "https://internal.svc"：tls：证书验证失败：x509：证书由未知机构签发

- **ID:** `go/http-tls-certificate-unknown-authority`
- **领域:** go
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

服务器使用私有 CA，其根证书不在系统信任库中，或容器缺少 ca-certificates。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| 1.18 | active | — | — |
| 1.21 | active | — | — |

## 解决方案

1. **** (90% 成功率)
   ```
   pool, _ := x509.SystemCertPool()
pem, _ := os.ReadFile("/etc/ssl/private-ca.pem")
pool.AppendCertsFromPEM(pem)
tr := &http.Transport{TLSClientConfig: &tls.Config{RootCAs: pool}}
   ```
2. **** (88% 成功率)
   ```
   Install ca-certificates in the container image and mount the private CA into /usr/local/share/ca-certificates.
   ```

## 无效尝试

- **** — Disables verification entirely, defeating TLS security in production. (90% 失败率)
- **** — Does not address the unknown authority issue. (85% 失败率)