# error: x509: certificate signed by unknown authority

- **ID:** `go/net-http-https-certificate-unknown-authority`
- **Domain:** go
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The server's TLS certificate is not signed by a trusted Certificate Authority, often due to self-signed certificates.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| 1.20 | active | — | — |
| 1.21 | active | — | — |

## Workarounds

1. **Add custom CA certificate to transport** (95% success)
   ```
   caCert, _ := os.ReadFile("ca.crt")
caCertPool := x509.NewCertPool()
caCertPool.AppendCertsFromPEM(caCert)
transport := &http.Transport{TLSClientConfig: &tls.Config{RootCAs: caCertPool}}
   ```

## Dead Ends

- **Setting InsecureSkipVerify to true globally** — Security risk; use custom root CA instead. (20% fail)