UntrustedRoot with self-signed certificate and custom CA signed cert #4607

1. Set the following values to the helm chart (deployed through ArgoCD)
githubServerTLS:
  certificateFrom:
    configMapKeyRef:
      name: mycert-ca
      key: ca.crt
  runnerMountPath: /usr/local/share/ca-certificates

The cert under key ca.crt is the selfsigned cert and I validated it using openssl that with this supplied it is "verified" from within the pod.

It's a self-signed cert at this time and it will be replaced by a cert signed by an internal CA. So either way using a custom CA should work.

In the spawned pod I see these env vars:
NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/ca.crt
RUNNER_UPDATE_CA_CERTS=1

The configmap is mounted into the pod on that location.

Just as a test I added SSL_CERT_DIR=/usr/local/share/ca-certificates and the error goes away.

If I try to verify using openssl with /etc/ssl/certs/ca-certificates.crt it's not ok. So it seems the update-ca-certificates is not running or something similar.

[RUNNER 2026-08-19 08:41:04Z ERR  GitHubActionsService] GET request to https://example.com/_services/pipelines/.../_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1 failed. System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
[RUNNER 2026-08-19 08:41:04Z ERR  GitHubActionsService]  ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot


There's no errors in the logs about update-ca-certificates.