x509: certificate signed by unknown authority

[alanhamlett]

Some Windows 10 machines are having problems connecting to a https server with Let's Encrypt cert (api.wakatime.com):
wakatime/wakatime-cli#385

The necessary cert is included in gocertifi (DST Root CA X3) but somehow it's not working in certain Windows environments.

If it makes a difference, the api.wakatime.com cert is signed by chaining an Intermediate certificate authority. That's the default for LetsEncrypt, and is working on most Windows 10 machines except the few that experience this error.

The code using gocertifi certs is here:
https://github.com/wakatime/wakatime-cli/blob/7c3c4167ec2003639a00effa34c157d0ddcd34d8/pkg/api/option.go#L167

[alanhamlett]

Closing because it can't be related to gocertifi, must be a bug in how we setup crypto/tls or how we're using net/http.