SSL connection could not be established, even with certificate provided

[dlecinasan]

Hello, we are running GitHub Actions self-hosted runners on our Kubernetes cluster via actions-runner-controller. The runner fails on registration due to the following error:

The SSL connection could not be established, see inner exception.

(No inner exception is visible)

We know this is probably due to an enterprise proxy which is in place for this connection, but we have tried to provide the certificate with all of the following options, independently and in combination:

apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
  name: runnerdeployment-simple
  namespace: actions-runner-system
spec:
  replicas: 1
  template:
    spec:
      organization: <redacted>
      env:
        - name: http_proxy
          value: http://proxy.<redacted>.com:443
        - name: https_proxy
          value: http://proxy.<redacted>.com:443
        - name: no_proxy
          value: <redacted>
        - name: GITHUB_ACTIONS_RUNNER_TLS_NO_VERIFY # temp
          value: '1' # temp
        - name: GIT_SSL_NO_VERIFY # temp
          value: 'true' # temp
        - name: GIT_SSL_CAINFO
          value: /etc/ssl/certs/<redacted>.crt
        - name: GIT_PROXY_SSL_CAINFO
          value: /etc/ssl/certs/<redacted>.crt
        - name: NODE_TLS_REJECT_UNAUTHORIZED # temp
          value: '0' # temp
        - name: NODE_EXTRA_CA_CERTS
          value: /etc/ssl/certs/<redacted>.crt
        - name: SSL_CERT_FILE
          value: /etc/ssl/certs/<redacted>.crt
        - name: SSL_CERT_DIR
          value: /etc/ssl/certs
        - name: DOTNET_SYSTEM_NET_HTTP_USESOCKETSHTTPHANDLER
          value: '0'
      volumes:
        - name: <redacted>
          configMap:
            name: <redacted>
      volumeMounts:
        - name: <redacted>
          mountPath: /etc/ssl/certs/<redacted>.crt
          subPath: <redacted>.crt
          readOnly: true

The certificate is provided via ConfigMap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: <redacted>
  namespace: actions-runner-system
data:
  <redacted>.crt: |
    -----BEGIN CERTIFICATE-----
    <redacted>
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    <redacted>
    -----END CERTIFICATE-----

The only option that "worked" was setting GITHUB_ACTIONS_RUNNER_TLS_NO_VERIFY to 1, but of course, we do not wish to keep it. With this option, we were able to register the runner and even run jobs on it.

What are we doing wrong?

[dlecinasan]

It turns out we were passing the wrong certificate file. With the correct file, we were able to reenable TLS and the runner registered properly.