x509: certificate signed by unknown authority
Go doesn't trust the certificate's issuer
Seen in Go (crypto/x509), Docker, Kubernetes tools, Terraform, Helm
Go could not chain the server certificate to a root CA in the system trust store.
Common causes
- A minimal container image (scratch, distroless or bare Alpine) with no CA certificates installed.
- A corporate proxy or private CA not in the system store.
- The server omits its intermediate certificate.
How to fix it
- Install CA certificates in the image (apk add ca-certificates, or copy /etc/ssl/certs/ca-certificates.crt into scratch images).
- Add your private CA to the system store, or point SSL_CERT_FILE or SSL_CERT_DIR at it.
- Fix the server to send the full chain.
Got a different message? Paste it into the error explainer.
Related errors
- [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed · Python couldn't verify the server's certificate
- certificate verify failed: Hostname mismatch, certificate is not valid for · The certificate doesn't cover this hostname
- PKIX path building failed · Java can't build a trusted certificate chain
- javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure · The server rejected the TLS handshake
- No subject alternative DNS name matching example.com found · The certificate doesn't cover this hostname
- x509: certificate is valid for X, not Y · The certificate doesn't cover this hostname
- remote error: tls: handshake failure · The server rejected the TLS handshake
- The SSL connection could not be established, see inner exception. · .NET could not complete the TLS handshake
- The remote certificate is invalid according to the validation procedure · .NET doesn't trust the server's certificate
- The request was aborted: Could not create SSL/TLS secure channel. · .NET Framework could not negotiate TLS
- cURL error 60: SSL certificate problem: unable to get local issuer certificate · PHP cURL can't verify the server's certificate
- stream_socket_enable_crypto(): SSL operation failed with code 1 · PHP failed to set up TLS on a stream