What version of Go are you using (go version)?

$ go version
go version go1.13.7 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN="/Users/fcjr/go/bin"
GOCACHE="/Users/fcjr/Library/Caches/go-build"
GOENV="/Users/fcjr/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/fcjr/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/Cellar/go/1.13.7/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.13.7/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/fcjr/Desktop/scratch/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/ky/y_d9mzjs4vn5b9py571zs8dm0000gn/T/go-build689674788=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Attempting to GET a website signed by USERtrust RSA Certification Authority returns x509: certificate signed by unknown authority even though the root certificate is in system roots with default settings of "Use System Defaults". At first I thought this might be due to #27175, however this issue occurs regardless of cgo being enabled or not. Note: the GET request succeeds on windows using the default system pool. @FiloSottile any thoughts on why this might be happening, could this be caused by the incomplete certificate chain on the given website? If so shouldn't the same issue occur on windows?

Here is a minimal example:

package main

import (
	"fmt"
	"log"
	"net/http"
)

func main() {
	res, err := http.Get("https://www.tian-restaurant.com/")
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(res.Status)
}

Certificate Chain:

Trust Settings:

What did you expect to see?

200 OK

What did you see instead?

Get https://www.tian-restaurant.com/: x509: certificate signed by unknown authority