X509 certificates with SSO issuer with DigiCert

[afer4152]

Hello,

I am using argo workflow with SSO and GitHub Connector (implemented with Dex).
It is working fine when everything is HTTP.
But when going with HTTPS I have a problem with issuer.
server crashes because certificate authority is not known:

time="2025-02-24T15:06:35.865Z" level=info msg="not enabling pprof debug endpoints"
time="2025-02-24T15:06:35.867Z" level=info authModes="[sso]" baseHRef=/ managedNamespace= namespace=argo secure=false
time="2025-02-24T15:06:35.868Z" level=warning msg="You are running in insecure mode. Learn how to enable transport layer security: https://argoproj.github.io/argo-workflows/tls/"
time="2025-02-24T15:06:35.868Z" level=info msg="config map" name=argo-workflows-workflow-controller-configmap
Error: Get "https://<DEX_URL>/.well-known/openid-configuration": x509: certificate signed by unknown authority
Usage:
  argo server [flags]

Examples:

See https://argoproj.github.io/argo-workflows/argo-server/

I'm using below helm charts
argo-workflows-0.10.1
dex-0.6.7.tgz

override value file

argo-workflows:
  sso:
   enabled: true
  images:
    pullSecrets:
    - name: <PULL_SECRET>
  server:
    extraArgs:
      - --auth-mode=sso
    serviceAccount:
      annotations:
        workflows.argoproj.io/rbac-rule: "'<ORG>:<GROUP' in groups"
        workflows.argoproj.io/rbac-rule-precedence: "1"
    ingress:
     ingressClassName: "internal"
     enabled: true
     hosts:
       - <argo.workflow.URL>
    secure: true
    insecureSkipVerify: true
    volumeMounts:
    - name: ca-pemstore
      mountPath: /etc/ssl/certs/ca.crt
      subPath: ca.crt
      readOnly: false
    volumes:
    - name: ca-pemstore
      configMap:
        name: dex-ca 
    sso:
      clientId:
        name: dex-static-client-credentials
        key: client-id
      clientSecret:
        name: dex-static-client-credentials
        key: client-secret
      scopes:
        - groups 
      rbac:
        enabled: true
      issuer: <https://DEX_URL>
      redirectUrl: https://<argo.workflow.URL>/oauth2/callback

dex:
  enabled: true
  imagePullSecrets:
  - name: <PULL_SECRET>
  ingress:
    className: internal
    hosts:
    - host: <DEX_URL>
      paths:
        - path: /
          pathType: ImplementationSpecific
  config:
    logger:
      level: debug
    issuer: https://<DEX_URL>
    staticClients:
      - id: <CLIENT_ID>
        redirectURIs:
        - https://<argo.workflow.URL>/oauth2/callback
        - https://<argo.rollout.URL>/oauth2/callback
        name: cx-sso-auth
        secret: <CLIENT_SECRET>
    connectors:
    - type: github
      id: github  
      name: GitHub
      config:          
        clientID: <CLIENT_ID_>
        clientSecret: <CLIENT_SECRET>
        redirectURI: https://<argo.workflow.URL>/callback
        orgs:
        - name: <ORG>
          teams: 
          - <TEAM_1>
          - <TEAM_2>

I have founded option in order to SSL verification via issue, but won't help.

How to solve it to use HTTPS endpoint for ARGO workflow SSO and DEX?

NOTE: https://DEX_URL SSL issued by Digicert and I hvae below .pem files

• Certificate.pem
• Intermediate_certificate.pem
• Root certificate.pem