# Getting \`signed by unknown authority\` error with certificates generated from tls-simple repo

**URL:** <https://community.temporal.io/t/getting-signed-by-unknown-authority-error-with-certificates-generated-from-tls-simple-repo/11574>\
**Category:** Server Deployment\
**Tags:** go-sdk, helm\
**Created:** [April 1, 2024, 2:00am UTC](https://community.temporal.io/t/getting-signed-by-unknown-authority-error-with-certificates-generated-from-tls-simple-repo/11574 "2024-04-01T02:00:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rijalbasanta](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/rijalbasanta/32/5148_2.png) [@rijalbasanta](https://community.temporal.io/u/rijalbasanta)\
**Post date:** [April 1, 2024, 2:00am UTC](https://community.temporal.io/t/getting-signed-by-unknown-authority-error-with-certificates-generated-from-tls-simple-repo/11574/1 "2024-04-01T02:00:45Z")

</div>

I have setup a self-hosted temporal in GKE using the helm charts with cloud-sql and postgres which is working. Now I am trying to add `TLS` to this. My goal is to have temporal server check and verify the certificates the client presents (go sdk) during connection. I have tried to use the certificates generated from tls-simple but keep getting the `signed by unknown authority` error. Here are the steps I followed:

1. edit cluster.conf to include `localhost` as DNS SAN:

```auto
[req]
default_bits = 4096
prompt = no
default_md = sha256
req_extensions = req_ext
distinguished_name = dn
[dn]
C = US
ST = WA
O = Test Cluster, Inc.
CN = tls-sample
[req_ext]
subjectAltName = @alt_names
[alt_names]
DNS.1 = tls-sample
DNS.2 = localhost
IP.1 = ::1

```

1. Ran _generate-test-certs.sh_ script in the [tls-simple](https://github.com/temporalio/samples-server/tree/main/tls/tls-simple) directory.
2. created secreted with the **ca.cert** , **cluster.key** , **cluster.pem** and mounted them to the deployments.
3. Setup the tls config as:

```auto
tls:
       frontend:
         server:
           certFile: /etc/certs/cluster.pem
           keyFile: /etc/certs/cluster.key
           requireClientAuth: true
           clientCaFiles:
             - /etc/certs/ca.cert
         client:
           serverName: tls-sample

```

1. Port-forwarded the frontend-headless service and tried to connect my go-client. Got the _failed to verify certificate: x509: certificate signed by unknown authority_ error.  
Go code:

```auto
//The client is a heavyweight object that should be created once per process.
	cert, err := tls.LoadX509KeyPair(
		"/home/rijalbasanta123/Downloads/temporal-base-code (1)/hello-world/certs/client.pem",
		"/home/rijalbasanta123/Downloads/temporal-base-code (1)/hello-world/certs/client.key",
	)
	if err != nil {
		log.Fatalln("Unable to load certs", err)
	}
	// Create the client object just once per process
	c, err := client.Dial(client.Options{
		HostPort: "localhost:7233",
		Namespace: "test",
		ConnectionOptions: client.ConnectionOptions{
			TLS: &tls.Config{Certificates: []tls.Certificate{cert}},
		},
	})
	if err != nil {
		log.Fatalln("unable to create Temporal client", err)
	}
	defer c.Close()

```

Is there somethings that I have missed here? I have checked locally that the certificates loaded in the go-client are verified by the ca.cert in set in the cluster.

---

<div class="post-metadata">

**Author:** ![freakytoad1](https://avatars.discourse-cdn.com/v4/letter/f/eada6e/32.png) [@freakytoad1](https://community.temporal.io/u/freakytoad1)\
**Post date:** [December 30, 2024, 6:49pm UTC](https://community.temporal.io/t/getting-signed-by-unknown-authority-error-with-certificates-generated-from-tls-simple-repo/11574/2 "2024-12-30T18:49:16Z")

</div>

@rijalbasanta Any luck getting past this?

---

<div class="post-metadata">

**Author:** ![AngeloBAIS](https://avatars.discourse-cdn.com/v4/letter/a/13edae/32.png) [@AngeloBAIS](https://community.temporal.io/u/AngeloBAIS)\
**Post date:** [February 20, 2025, 4:38pm UTC](https://community.temporal.io/t/getting-signed-by-unknown-authority-error-with-certificates-generated-from-tls-simple-repo/11574/3 "2025-02-20T16:38:49Z")

</div>

I resolved this error by adding the following to the Temporal DockerFile

RUN apk update && apk add --no-cache ca-certificates  
RUN update-ca-certificates