Pact Broker SSL "certificate verify failed" in CI

By Kaveh Alemi·Latchkey

The client opened a TLS connection to the broker but could not validate its certificate chain against the runner CA bundle. This hits self-hosted brokers with a private or self-signed certificate.

What this error means

Publish or verify fails with "SSL_connect returned=1 ... certificate verify failed" or "self signed certificate in certificate chain" for the broker URL.

Error making request to https://pact-broker.internal
SSL_connect returned=1 errno=0 state=error: certificate verify failed
(unable to get local issuer certificate)

Common causes

A self-signed or private CA certificate on the broker

The broker presents a certificate signed by a CA that is not in the runner trust store, so validation fails.

A stale or missing CA bundle on the runner

A slim runner image with outdated ca-certificates cannot validate the broker chain.

How to fix it

Trust the broker CA on the runner

1. Add the broker CA certificate to the runner trust store.
2. Point the client CA bundle env var at it.
3. Re-run so the handshake validates.

export SSL_CERT_FILE=/etc/ssl/certs/corp-ca.pem
pact-broker publish ./pacts --broker-base-url "$PACT_BROKER_BASE_URL"

Update the runner CA store

Refresh ca-certificates so the chain validates without ad hoc bundles.

sudo apt-get update && sudo apt-get install -y ca-certificates
sudo update-ca-certificates

How to prevent it

• Install the broker CA into the runner trust store, not into flags.
• Keep ca-certificates current in custom runner images.
• Avoid disabling TLS verification as a permanent fix.

Frequently asked questions

Related guides

References

• GitHub Actions documentation