Go/Docker "x509: certificate signed by unknown authority" in CI
A Go-based client (the Docker daemon, kubectl, Go tooling) validated the TLS chain and reached a root it does not recognize. The certificate is signed by a CA that is not in the system trust store, typically a corporate proxy or a private registry CA.
What this error means
docker pull, docker login, or a Go program fails with "x509: certificate signed by unknown authority", often naming the registry or proxy host.
Error response from daemon: Get "https://registry.corp.example/v2/":
x509: certificate signed by unknown authorityCommon causes
The signing CA is not in the system trust store
Go clients read the OS trust store; a private or proxy CA that was never installed there is treated as unknown.
A private registry uses an internal certificate
The registry presents a certificate from an internal CA the daemon has never been given.
How to fix it
Install the CA into the system trust store
Add the CA so every Go client, including dockerd, validates against it.
cp corp-root-ca.crt /usr/local/share/ca-certificates/
update-ca-certificatesTrust the CA for a specific registry
For a private registry, place the CA where the Docker daemon looks per host, then restart the daemon.
mkdir -p /etc/docker/certs.d/registry.corp.example
cp ca.crt /etc/docker/certs.d/registry.corp.example/ca.crtHow to prevent it
- Bake internal and proxy CAs into runner images and run
update-ca-certificates. - Use
/etc/docker/certs.d/<host>for private registry CAs rather than insecure flags. - Keep the trust store in one place used by dockerd and other Go tools.