Go 'x509: certificate signed by unknown authority' (or 'x509: failed to load system roots and no roots provided') in a scratch or distroless container: how do I fix it without skipping verification?

Cause: Go verifies TLS certificates against root CAs from the operating system. On Linux the crypto/x509 package reads a bundle file such as /etc/ssl/certs/ca-certificates.crt (and other known paths) and the directories /etc/ssl/certs and /etc/pki/tls/certs. A FROM scratch image has none of these, so every HTTPS call fails. The same error also appears when a corporate proxy re-signs traffic with a private CA that the image doesn't trust. Fix (best first): 1. Use a base that ships roots. Google's distroless static image (intended for statically compiled apps such as Go) includes ca-certificates, tzdata and a /tmp directory. Example: FROM gcr.io/distroless/static AS final. 2. Or copy the bundle into a scratch image from your build stage: COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ (the build stage must have ca-certificates installed). 3. For a private or corporate CA, add its PEM to the image's trust bundle, or point Go at it with SSL_CERT_FILE=/path/to/ca.pem or SSL_CERT_DIR (these override the default locations). In code you can start from x509.SystemCertPool() and AppendCertsFromPEM your CA into a copy, then set it as RootCAs in tls.Config. 4. If you cannot ship a bundle at all, there is no safe shortcut; prefer a base image that includes roots. Don't: set InsecureSkipVerify: true or disable verification; that removes protection against interception and credential theft. Verify: Run the container and make the HTTPS request; it succeeds with verification still on. Check the file exists inside the image (a debug distroless variant has a shell for this). Sources: https://pkg.go.dev/crypto/x509 https://go.dev/src/crypto/x509/root_linux.go https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md