act_runner self-signed instance TLS (certificate) in CI

By Daniel Zoghalchali·Latchkey

act_runner connects to the Gitea instance over TLS and validates its certificate. A self-signed or private-CA certificate not in the runner host trust store makes the connection fail before registration or polling.

What this error means

act_runner fails to register or poll with an x509 error naming an unknown authority for the instance host, even though the URL is correct.

level=fatal msg="failed to connect to https://gitea.internal :
x509: certificate signed by unknown authority"

Common causes

A self-signed instance certificate

The instance presents a certificate signed by a CA the runner host does not trust, so verification fails.

A private CA missing from the runner trust store

An internal CA is used for the instance but its root is not installed on the runner host.

How to fix it

Install the instance CA on the runner host

1. Obtain the instance CA (or self-signed cert) in PEM form.
2. Add it to the runner host trust store and update it.
3. Restart act_runner so it validates the chain.

sudo cp gitea-ca.pem /usr/local/share/ca-certificates/gitea-ca.crt
sudo update-ca-certificates
systemctl restart act_runner

Provide the CA to a containerized runner

When act_runner runs in a container, mount the CA bundle and update certs inside so the instance chain validates.

docker run -d \
  -v $PWD/gitea-ca.pem:/usr/local/share/ca-certificates/gitea-ca.crt:ro \
  gitea/act_runner:latest

How to prevent it

• Install the instance CA into the runner trust store at provisioning.
• Prefer a real or private-CA certificate over per-runner overrides.
• Keep the runner host ca-certificates package current.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions