非自签名证书给出了由未知授权机构签名的证书错误

Question

I have an API server using a non-self signed certificate issued by a respected CA. When I connect to this server I get the following error:

x509: certificate signed by unknown authority

I connect using a golang client using the net/http library. The certificate is properly configured as I do not get an error complaining about it.

I did not expect this error because I am using a CA. I am not getting the error when using a web browser.

Answer 1

The problem was that I did not pass the intermediate CA certificate to the http server. The method http.ListenAndServeTLS requires the intermediate CA certificate in the same certificate file.

The fix was easy, just add the intermediate certificate of your CA in your certificate file:

-----BEGIN CERTIFICATE-----
<YOUR OWN CERTIFICATE>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<INTERMEDIATE CA CERTIFICATE>
-----END CERTIFICATE-----