Go "x509: certificate signed by unknown authority" - Fix in CI

By Daniel Zoghalchali·Latchkey

When a corporate proxy intercepts TLS, Go sees a certificate signed by the proxy CA, not the real one. Without that CA in the trust store, module fetches fail with an x509 error.

What this error means

A module fetch fails with x509: certificate signed by unknown authority. A TLS-intercepting proxy in front of the proxy/sumdb presents a cert the runner does not trust.

go: example.com/lib@v1.2.0: ... tls: failed to verify certificate: x509: certificate signed by unknown authority

Diagnose it: module path, proxy, or checksum?

Go module errors name the module but rarely the layer that failed. Separate the three: the module path does not resolve, the proxy cannot serve it, or the checksum database disagrees with what was downloaded.

# what Go resolves and from where
go env GOPROXY GOSUMDB GOPRIVATE GOFLAGS

# does the module resolve at all, bypassing the build?
go list -m -versions github.com/org/module

# verify the module cache against go.sum
go mod verify

# private modules must be excluded from proxy and sumdb
go env -w GOPRIVATE=github.com/yourorg/*

Common causes

TLS-intercepting proxy

A proxy re-signs HTTPS with its own CA, which the runner does not trust by default.

Missing corporate CA in trust store

The internal CA was never added to the runner system trust store.

How to fix it

Trust the proxy CA

1. Install the corporate CA into the system trust store before fetching.

- run: |
    sudo cp corp-ca.crt /usr/local/share/ca-certificates/
    sudo update-ca-certificates

Point Go at a CA bundle

1. Set SSL_CERT_FILE to a bundle that includes the proxy CA.

env:
  SSL_CERT_FILE: /etc/ssl/certs/corp-bundle.pem

How to prevent it

• Bake the corporate CA into the runner image trust store.
• Point SSL_CERT_FILE at a complete bundle when needed.
• Avoid disabling TLS verification as a workaround.

Frequently asked questions

Related guides

References

• Go documentation
• GitHub Actions documentation