Go "x509: certificate signed by unknown authority" - Fix in CI

By Daniel Zoghalchali·Latchkey

When a corporate proxy intercepts TLS, Go sees a certificate signed by the proxy CA, not the real one. Without that CA in the trust store, module fetches fail with an x509 error.

What this error means

A module fetch fails with x509: certificate signed by unknown authority. A TLS-intercepting proxy in front of the proxy/sumdb presents a cert the runner does not trust.

go: example.com/lib@v1.2.0: ... tls: failed to verify certificate: x509: certificate signed by unknown authority

Common causes

TLS-intercepting proxy

A proxy re-signs HTTPS with its own CA, which the runner does not trust by default.

Missing corporate CA in trust store

The internal CA was never added to the runner system trust store.

How to fix it

Trust the proxy CA

1. Install the corporate CA into the system trust store before fetching.

- run: |
    sudo cp corp-ca.crt /usr/local/share/ca-certificates/
    sudo update-ca-certificates

Point Go at a CA bundle

1. Set SSL_CERT_FILE to a bundle that includes the proxy CA.

env:
  SSL_CERT_FILE: /etc/ssl/certs/corp-bundle.pem

How to prevent it

• Bake the corporate CA into the runner image trust store.
• Point SSL_CERT_FILE at a complete bundle when needed.
• Avoid disabling TLS verification as a workaround.

Frequently asked questions

Related guides

References

• Go documentation
• GitHub Actions documentation