How to Solve: x509: certificate signed by unknown authority on GitHub Enterprise Server

[loujr]

Summary

The message in the UI says "We couldn't deliver this payload: x509: certificate signed by unknown authority". Webhooks are failing due to a recently expired or updated certificate on GitHub Enterprise Server. The GHES certificate itself is valid, but GHES doesn't recognize the local certificate authority (CA) or self-signed certificate on the webhook destination host.

Symptoms

Messages like this appear in the UI and webhooks are not deliverable.

x509: certificate signed by unknown authority

Resolution

To resolve this error, perform the following steps:

1. Reinstall the signed certificate.

   ghe-ssl-ca-certificate-install -c NameOfYourRootCertificateAuthority.crt

2. Restart hookshot-go.

   nomad stop hookshot-go
   nomad run /etc/nomad-jobs/hookshot-go/hookshot-go.hcl

3. On the organization's webhook page, click Redelivery on the recently failed deliveries. The deliveries should redeliver successfully.

If this procedure does not resolve the issue, please open a support ticket and send screenshots of all the error messages you are receiving and the IDs of the failed webhook deliveries.

Additional Resources

• Installing self-signed or untrusted certificate authority (CA) root certificates