how can i add certificate?

[MelekhSV]

Hello
I install talos on server in the organization
I encountered with next problem when i send configuration to the talos server.
I saw error tls failed to verify certificate
How can i add certificate ?

[smira]

Please see documentation.

[MelekhSV]

Hello
I made next step

1. I generate manifest using next commange - talosctl gen config gpu129 https://ip_address:6443
2. create ca.yaml ( I attatch below ca.yaml)
3. talosctl apply-config --nodes ip_address --file ca.yaml --insecure
4. talosctl apply-config --insecure -n ip_address --file ./controlplane.yaml

And I saw next error - failed to request : Head "https://ghcr.io/v2/siderolabs/installer/manifests/v1.11.1": tls: failed to verify certificate: x509 certificate signed by unkwon authority host=ghcr.io image=ghcr.io/siderolabs/installer/v1.11.1

talosctl version
Client:
Tag: v1.11.1
SHA: 8e85c83
Built:
Go version: go1.24.6
OS/Arch: linux/amd6
ca.yaml

[MelekhSV]

Also I try to add certificate using patching. I attatch below patch file
I using next commant for patching

1. talosctl machineconfig patch controlplane.yaml --patch @patch.yaml -o master.yaml
   2)talosctl validate --config master.yaml --mode metal
   master.yaml is valid for metal mode

patch.yaml

[smira]

From your description it's not possible to understand what you're doing.

You can check machine config on the node with talosctl get mc -o yaml - it should contain TrustedRootDocument.

Also not sure why ghcr.io doesn't validate.

[MelekhSV]

I want to deploy Talos in my organization on a server.
I boot Talos from a USB flash drive — I've already downloaded the ISO image beforehand.
Then I insert the USB drive into the server.

From my workstation, I use the talosctl utility to generate configuration manifests: talosctl gen config gpu129 https://ip_address:6443
I apply the manifests to the server using: talosctl apply-config --insecure -n ip_address --file ./controlplane.yaml
However, in the installation logs I see the following error: failed to request: Head "https://ghcr.io/v2/siderolabs/installer/manifests/v1.11.1": tls: failed to verify certificate: x509: certificate signed by unknown authority
host=ghcr.io image=ghcr.io/siderolabs/installer/v1.11.1

[smira]

I can't guess what it is, but you have some kind of Man In the Middle going on there specific to your network. You might need to figure out what is happening in your network, and then look for a solution.