How to fix HTTPS probe failed: x509: certificate signed by unknown authority in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 103 views

HTTPS liveness/readiness probes fail due to invalid or self-signed certificates. Probes cannot verify the server certificate, causing health checks to fail.

Quick fix

Fixes HTTPS probe failed: x509: certificate signed by unknown authority

  1. Step 1
  2. Step 2
  3. Step 3
  4. Step 4
  5. Step 5
kubernetes — error
# HTTPS probe failed: x509: certificate signed by unknown authority
HTTPS probe failed: x509: certificate signed by unknown authority

What this error means

HTTPS liveness/readiness probes fail due to invalid or self-signed certificates. Probes cannot verify the server certificate, causing health checks to fail. Kubernetes uses strict certificate validation by default and will reject unverified certificates.

Typical symptoms

  • Probe events: "HTTPS probe failed: x509: certificate signed by unknown authority"
  • Pod keeps restarting due to failed HTTPS probes
  • HTTP probes work but HTTPS probes fail
  • curl to pod shows certificate validation error
  • Pod cannot serve HTTPS traffic
  • Self-signed certificates rejected by probes
  • Intermittent probe failures if certificate expires

Common causes

  1. Application using self-signed certificate not trusted by kubelet
  2. Certificate expired or invalid
  3. Wrong certificate installed on pod
  4. Certificate does not match service domain name
  5. CA certificate not in system trust store
  6. Probe configured with wrong TLS settings
  7. Certificate revoked or blacklisted

How to fix "HTTPS probe failed: x509: certificate signed by unknown authority"

1Step 1

First diagnostic step

2Step 2

Second diagnostic step

3Step 3

Third diagnostic step

4Step 4

Fourth diagnostic step

5Step 5

Fifth diagnostic step

Advanced notes

Additional notes and platform-specific considerations.

Frequently asked questions

What does "HTTPS probe failed: x509: certificate signed by unknown authority" mean?
HTTPS liveness/readiness probes fail due to invalid or self-signed certificates. Probes cannot verify the server certificate, causing health checks to fail. Kubernetes uses strict certificate validation by default and will reject unverified certificates.
How do I fix "HTTPS probe failed: x509: certificate signed by unknown authority"?
HTTPS liveness/readiness probes fail due to invalid or self-signed certificates. Probes cannot verify the server certificate, causing health checks to fail.
What causes "HTTPS probe failed: x509: certificate signed by unknown authority"?
Application using self-signed certificate not trusted by kubelet Certificate expired or invalid Wrong certificate installed on pod
Is the "HTTPS probe failed: x509: certificate signed by unknown authority" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading