UntrustedRoot with self-signed certificate and custom CA signed cert

Checks

• I've already read https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/troubleshooting-actions-runner-controller-errors and I'm sure my issue is not covered in the troubleshooting guide.
• I am using charts that are officially provided

Controller Version

0.14.2

Deployment Method

ArgoCD

Checks

• This isn't a question or user support case (For Q&A and community support, go to Discussions).
• I've read the Changelog before submitting this issue and I'm sure it's not due to any recently-introduced backward-incompatible changes

To Reproduce

1. Set the following values to the helm chart (deployed through ArgoCD)
githubServerTLS:
  certificateFrom:
    configMapKeyRef:
      name: mycert-ca
      key: ca.crt
  runnerMountPath: /usr/local/share/ca-certificates

The cert under key ca.crt is the selfsigned cert and I validated it using openssl that with this supplied it is "verified" from within the pod.

It's a self-signed cert at this time and it will be replaced by a cert signed by an internal CA. So either way using a custom CA should work.

In the spawned pod I see these env vars:
NODE_EXTRA_CA_CERTS=/usr/local/share/ca-certificates/ca.crt
RUNNER_UPDATE_CA_CERTS=1

The configmap is mounted into the pod on that location.

Just as a test I added SSL_CERT_DIR=/usr/local/share/ca-certificates and the error goes away.

If I try to verify using openssl with /etc/ssl/certs/ca-certificates.crt it's not ok. So it seems the update-ca-certificates is not running or something similar.

[RUNNER 2026-08-19 08:41:04Z ERR  GitHubActionsService] GET request to https://example.com/_services/pipelines/.../_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1 failed. System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
[RUNNER 2026-08-19 08:41:04Z ERR  GitHubActionsService]  ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot


There's no errors in the logs about update-ca-certificates.

Describe the bug

The added ca certificate is not being added to the system trust store.

Describe the expected behavior

The ca certificate is being added to the system trust store.

Additional Context

githubServerTLS:
  certificateFrom:
    configMapKeyRef:
      name: mycert-ca
      key: ca.crt
  runnerMountPath: /usr/local/share/ca-certificates

Controller Logs

[RUNNER 2026-08-19 08:41:04Z ERR  GitHubActionsService] GET request to https://example.com/_services/pipelines/.../_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1 failed. System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
[RUNNER 2026-08-19 08:41:04Z ERR  GitHubActionsService]  ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot

Runner Pod Logs

[RUNNER 2026-08-19 08:41:04Z ERR  GitHubActionsService] GET request to https://example.com/_services/pipelines/.../_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1 failed. System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.
[RUNNER 2026-08-19 08:41:04Z ERR  GitHubActionsService]  ---> System.Security.Authentication.AuthenticationException: The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot

Start with the Helm chart's githubServerTLS handling and the generated runner pod's certificate mount and environment variables. Reproduce the self-signed and internal-CA cases, then inspect how RUNNER_UPDATE_CA_CERTS updates the trust store compared with SSL_CERT_DIR. Done means the supplied CA is trusted without manually setting SSL_CERT_DIR and the UntrustedRoot error is gone.