unknown_ca
unknown_ca (48) is sent when the certificate chain was valid but the root CA is not recognized or trusted. The certificate itself is properly formed and signed, but the CA that signed it is not in the receiver's trust store. This is the explicit code for untrusted CA, while certificate_unknown (46) is the fallback.
Alert Code
48
Level
Fatal
Standard
RFC 8446
Description
unknown_ca is more specific than certificate_unknown – it explicitly signals that the issuing CA is not trusted. When a client authenticates to a server that requires mutual TLS (mTLS), and the client's certificate was issued by an internal CA not known to the server, the server sends unknown_ca. This is common in microservice mTLS deployments where services must configure the set of trusted CA certificates for peer verification.
Common Causes
- –Client certificate issued by an internal CA not trusted by the server
- –mTLS deployment with misconfigured trusted CA list
- –Root CA certificate not installed in the TLS library's trust store
- –Custom CA for development environment not added to system roots