How to fix x509: certificate signed by unknown authority in Kubernetes

KubernetesINTERMEDIATEHIGHUpdated Dec 6, 2025· 248 views

Your kubectl cannot verify the API server certificate because it doesn't trust the signing authority. This is typically a CA certificate mismatch.

Quick fix

Fixes x509: certificate signed by unknown authority

kubectl config view --flatten | grep certificate-authority-data | head -1 | awk '{print $2}' | base64 -d > /tmp/server-ca.crt
  1. Extract the CA certificate from the API server
  2. Verify your kubeconfig CA certificate
  3. Update kubeconfig with correct CA certificate
  4. Use the server's default CA if needed
kubernetes — error
kubectl config view --flatten | grep certificate-authority-data | head -1 | awk '{print $2}' | base64 -d > /tmp/server-ca.crt
x509: certificate signed by unknown authority

What this error means

When kubectl connects to the API server, it validates the server's TLS certificate against a certificate authority (CA). If the CA certificate in kubeconfig doesn't match the CA that signed the server certificate, or if the CA certificate is missing/incorrect, the validation fails.

Typical symptoms

  • kubectl fails with "unknown authority" error
  • Cannot connect to API server despite correct address
  • Error occurs for all kubectl commands
  • CA file not found or invalid in kubeconfig
  • Intermittent failures if certificates are being rotated
  • Self-signed certificate warnings

Common causes

  1. CA certificate in kubeconfig doesn't match server certificate
  2. CA certificate file is missing or corrupted
  3. API server certificate was signed by different CA
  4. Kubeconfig points to wrong CA file path
  5. Certificate rotation occurred but kubeconfig not updated
  6. Using self-signed certificates without importing them

How to fix "x509: certificate signed by unknown authority"

1Extract the CA certificate from the API server

Get the actual CA from the server:

bash
kubectl config view --flatten | grep certificate-authority-data | head -1 | awk '{print $2}' | base64 -d > /tmp/server-ca.crt

Or directly from the server:

bash
openssl s_client -connect YOUR_API_SERVER:6443 -showcerts < /dev/null | openssl x509 -out /tmp/server-ca.crt
2Verify your kubeconfig CA certificate

Check what CA your kubeconfig is using:

bash
kubectl config view --raw | grep certificate-authority-data

Extract and compare:

bash
echo YOUR_CERT_DATA | base64 -d > /tmp/kubeconfig-ca.crt
openssl x509 -in /tmp/kubeconfig-ca.crt -text -noout
3Update kubeconfig with correct CA certificate

Update the CA reference in kubeconfig:

bash
kubectl config set-cluster kubernetes --certificate-authority=/path/to/correct/ca.crt

Or update manually in ~/.kube/config

4Use the server's default CA if needed

For self-signed certificates, you can skip verification (not recommended for production):

bash
kubectl config set-cluster kubernetes --insecure-skip-tls-verify=true

Or properly import the CA:

bash
kubectl config set-cluster kubernetes --certificate-authority=/etc/kubernetes/pki/ca.crt
5Test the connection

Verify the fix:

bash
kubectl version
kubectl get nodes

Both should now succeed without certificate errors.

Advanced notes

Store CA certificates securely. For cluster bootstrapping, ensure CA distribution happens before kubeconfig generation. When rotating certificates in kubeadm, use: kubeadm certs renew all. Use certificate management tools (cert-manager) for automatic rotation in production. Never skip TLS verification in production—fix the certificate issue instead.

Frequently asked questions

What does "x509: certificate signed by unknown authority" mean?
When kubectl connects to the API server, it validates the server's TLS certificate against a certificate authority (CA). If the CA certificate in kubeconfig doesn't match the CA that signed the server certificate, or if the CA certificate is missing/incorrect, the validation fails.
How do I fix "x509: certificate signed by unknown authority"?
Your kubectl cannot verify the API server certificate because it doesn't trust the signing authority. This is typically a CA certificate mismatch.
What causes "x509: certificate signed by unknown authority"?
CA certificate in kubeconfig doesn't match server certificate CA certificate file is missing or corrupted API server certificate was signed by different CA
Is the "x509: certificate signed by unknown authority" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading