# Kubernetes Image Pull "x509: certificate signed by unknown authority"

> Fix Kubernetes image pulls failing with "x509: certificate signed by unknown authority" in CI - a private registry using a self-signed or untrusted CA the nodes do not trust.

Source: https://latchkey.dev/learn/kubernetes/k8s-image-pull-x509-certificate  
Updated: 2026-06-25

The kubelet could not verify the TLS certificate of your private registry. The registry presents a self-signed or internal-CA certificate that the nodes’ trust store does not contain.

## Diagnose it: read events and previous logs

```Terminal
kubectl --context "$KUBE_CONTEXT" -n "$NS" get pods -o wide
kubectl -n "$NS" describe pod <pod> | sed -n "/Events/,$p"
kubectl -n "$NS" logs <pod> --previous --tail=50
```

> `--previous` returns the logs of the container that already died, which is the one that explains a restart loop. The running container is usually still starting and explains nothing.

## FAQ

### What causes Kubernetes image pull "x509: certificate signed by unknown authority"?

There are 2 common causes: registry ca not in the node trust store and incomplete certificate chain. A self-signed or private-CA registry certificate is not trusted by the container runtime on the nodes, so TLS verification fails.

### How do I fix Kubernetes image pull "x509: certificate signed by unknown authority"?

There are 2 fixes depending on which cause you have: trust the registry ca on the nodes and serve the full chain. Work through them in order, since the first is the most common.

### What does Kubernetes image pull "x509: certificate signed by unknown authority" actually mean?

Pods fail to pull from a private registry with x509: certificate signed by unknown authority (or failed to verify certificate).

### How do I stop Kubernetes image pull "x509: certificate signed by unknown authority" happening again?

Distribute the registry CA via node bootstrap so every node trusts it. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt