Kubernetes Image Pull "x509: certificate signed by unknown authority"

By Daniel Zoghalchali·Latchkey

The kubelet could not verify the TLS certificate of your private registry. The registry presents a self-signed or internal-CA certificate that the nodes’ trust store does not contain.

What this error means

Pods fail to pull from a private registry with x509: certificate signed by unknown authority (or failed to verify certificate). Public-registry images pull fine; only the internal registry fails.

kubectl describe pod

Failed to pull image "registry.internal:5000/api:1.0": failed to do request:
Head "https://registry.internal:5000/v2/api/manifests/1.0": x509: certificate
signed by unknown authority

Common causes

Registry CA not in the node trust store

A self-signed or private-CA registry certificate is not trusted by the container runtime on the nodes, so TLS verification fails.

Incomplete certificate chain

The registry serves a leaf cert without its intermediate CA, so the runtime cannot build a path to a trusted root.

How to fix it

Trust the registry CA on the nodes

Install the registry’s CA into the container runtime’s per-registry certs directory (containerd shown).

Terminal

# on each node (or via DaemonSet / node bootstrap)
mkdir -p /etc/containerd/certs.d/registry.internal:5000
cp ca.crt /etc/containerd/certs.d/registry.internal:5000/ca.crt

Serve the full chain

Configure the registry to present leaf + intermediate certificates.
Verify the chain with openssl s_client -connect registry.internal:5000 -showcerts.
Roll the CA out through node bootstrap so new nodes trust it automatically.

How to prevent it

Distribute the registry CA via node bootstrap so every node trusts it.
Serve the complete certificate chain from the registry.
Prefer certificates from a CA the cluster already trusts.

Frequently asked questions

What causes "registry x509 cert error"?