TLS Certificate Verification Failure on Go Build in Docker container

David Y.

—October 15, 2024

The Problem

In the process of dockerizing my Go application, I encounter the following error on the go build step:

main.go:6:2: github.com/yuin/goldmark/v@v1.7.4: Get "https://proxy.golang.org/github.com/yuin/goldmark/@v/v1.7.4.zip": tls: failed to verify certificate: x509: certificate signed by unknown authority

However, if I visit https://proxy.golang.org/github.com/yuin/goldmark/@v/v1.7.4.zip in my browser, the module is downloaded without a TLS error.

Here’s my Dockerfile, which I’ve placed in my project’s root directory:

FROM golang:latest as builder
RUN mkdir /app

COPY . /app
WORKDIR /app

# This step fails:
RUN CGO_ENABLED=0 go build -o myApp ./main

RUN chmod +x /app/myApp

CMD [ "/app/myApp" ]

The Solution

The most likely cause of this error is a mismatch between the CA certificates installed on your host device and the CA certificates installed in the docker container.

These could either be generic CA certificates or ones specific to your network. Many corporate networks require custom CA certificates to be installed, which are used to proxy all or most TLS traffic on the network.

If the issue is caused by missing generic certificates, you can fix it by installing the ca-certificates package before building your application:

FROM golang:latest as builder
RUN mkdir /app

COPY . /app
WORKDIR /app

# new step:
RUN apt install ca-certificates
RUN CGO_ENABLED=0 go build -o myApp ./main

RUN chmod +x /app/myApp

CMD [ "/app/myApp" ]

If you encounter the same error after this change, the issue is network-specific and you likely need to install a CA certificate specific to your corporate network.

Many corporate networks require custom CA certificates, which are used to proxy all or most TLS traffic on the network.

If you’re using Google Chrome, Brave, Edge, or another Chromium-based browser, download the certificate as follows:

1. Visit the URL from the error message.
2. Click the View site information icon on the left side of the address bar.
3. Click Connection is secure and then Certificate is valid.
4. In the window that appears, visit the Details tab and click Export…
5. Save the certificate file to your project’s root directory.

If you’re using Firefox, download the certificate as follows:

1. Visit the URL from the error message.
2. Click the padlock icon on the left side of the address bar.
3. Click Connection secure and then More information.
4. In the window that appears, click View Certificate.
5. Scroll down until you see a link that says PEM (chain).
6. Click that link to download the certificate, and then move the file to your project’s root directory.

Now that you have the certificate, you can copy it into your container by changing the Dockerfile as below:

FROM golang:latest as builder
RUN mkdir /app

COPY . /app
WORKDIR /app

# install generic certificates:
RUN apt install ca-certificates
# install corporate certificate:
COPY downloaded-cert.pem /etc/ssl/certs/downloaded-cert.pem
RUN CGO_ENABLED=0 go build -o myApp ./main

RUN chmod +x /app/myApp

CMD [ "/app/myApp" ]

It should now be possible to build the container without further TLS errors.