@vitaliy-kuzmich, note that the issue to which you are replying was specific to Darwin (a.k.a. macOS).

I'm guessing that 509: certificate signed by unknown authority will probably not be enough information to diagnose the issue. Are you able to share more detail about the certificate that failed the test?

@vitaliy-kuzmich, @FiloSottile was asking for folks to run the test, but gotip build -a -o test will instead build the non-test sources for the package. Can you provide the complete list of commands that you ran?

@bcmills Thank you for quick response, indeed it is not darwin, but I have exactly same on mipsle on my router. I am trying to run cross compiled binary on embedded device. Here it is source code that I used for test :

package main

import (
	"fmt"
	"io/ioutil"
	"log"
	"net/http"
	"net/http/cookiejar"
)

func main() {
	jar, _ := cookiejar.New(nil)

	client := http.Client{Jar: jar}
	res, err := client.Get("https://google.com")
	check(err)
	rs, err := ioutil.ReadAll(res.Body)
	fmt.Println(string(rs))
}
func check(err error) {
	if err != nil {
		log.Fatal(err)
	}
}

I am not sure, but /etc/ssl/certs empty on embedded device, should there be some certs ? Or built binary should create it ?
upd: Did copy certs from host to the embedded device, still have this issue, have no idea what goes wrong.

@vitaliy-kuzmich, you can use go test -c to compile a test binary without running it.

I don't know how you would need to configure the root certs on a router so that a Go binary can find them.

Apologies, my fault, there is nothing wrong with go, works like a charm. I use openwrt system, for some reasons certificate package were missed. It so cool that same code works on different devices!

@bcmills Just thinking maybe make message more clear ? Like "none certificates was found at default paths" or something, because it really confuses if say if it signed by unknown authority,but the file just does not exists.

@vitaliy-kuzmich, clearer error messages are always nice to have.

If you could post specific steps that we can run to reproduce the issue (preferably as a new issue on GitHub), I'd be happy to leave it open as help wanted for anyone interested to fix.

@vitaliy-kuzmich which package did you need to install?

@bernardoaraujor https://openwrt.org/packages/pkgdata/ca-bundle

I'm actually working on an OpenEmbedded based system. But your solution pointed me in the right direction, so thanks @vitaliy-kuzmich

For anyone that might be interested, I solved this by adding RDEPENDS_${PN} += "ca-certificates" to my BitBake recipe.