curl "(60) SSL certificate problem: self signed certificate" in CI
The server presented a certificate that signs itself instead of chaining to a public CA. curl has no trust anchor for it and stops with error 60. On a CI runner this is normal for internal registries, staging hosts, or a TLS-inspecting proxy, and the fix is to trust that specific certificate, not to disable verification.
What this error means
curl fails with "curl: (60) SSL certificate problem: self signed certificate" against an internal or staging HTTPS endpoint, while public HTTPS sites work.
curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.se/docs/sslcerts.htmlCommon causes
The endpoint uses a self-signed certificate
An internal service or registry serves a certificate it signed itself, so there is no CA chain for curl to validate.
A proxy injects a self-signed root
A TLS-inspecting proxy terminates the connection with its own self-signed root that the runner does not trust.
How to fix it
Trust the specific certificate
- Obtain the server or proxy certificate as a PEM file.
- Add it to the system store, or pass it with
--cacertfor that request. - Re-run and confirm curl now validates the chain.
# export the cert once, then trust it
echo | openssl s_client -connect internal.example.com:443 2>/dev/null \
| openssl x509 > internal.pem
curl --cacert internal.pem https://internal.example.comInstall the internal CA into the store
If the self-signed cert is a private CA root, add it to the trust store so every tool on the runner validates it.
sudo cp internal-root.crt /usr/local/share/ca-certificates/
sudo update-ca-certificatesHow to prevent it
- Distribute the internal CA to runner images so self-signed chains validate.
- Prefer certificates issued by an internal CA over per-host self-signed certs.
- Avoid
-k; trust the exact certificate so a real substitution still fails.