Mend.io Hosted - UNABLE_TO_VERIFY_LEAF_SIGNATURE Error getting nuget packages from private feed

[tknutson]

How are you running Renovate?

A Mend.io-hosted app

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

No response

Please tell us more about your question or problem

Getting UNABLE_TO_VERIFY_LEAF_SIGNATURE error getting nuget packages from private feed.

Our private feed uses CA Starfield. I tried adding this to my config with no luck:

Is Starfield covered under Mozilla well-known CA GoDaddy?
Am I setting httpsCertificateAuthority incorrectly? I tried just "Starfield" as well.
Or do I need httpsCertificate and/or httpsPrivateKey?

Thank you.

Logs (if relevant)

Logs

DEBUG: GET https://[internalNugetFeed]/httpAuth/app/nuget/v1/FeedService.svc/FindPackagesById()?id=%27SignZone.Enterprise.NLogFacade%27&$select=Version,IsLatestVersion,ProjectUrl,Published = (code=UNABLE_TO_VERIFY_LEAF_SIGNATURE, statusCode=-1 retryCount=0, duration=199)
{
"baseBranch": "feature/Sprint_162_Hotfix"
}

DEBUG: Datasource connection error
{
"baseBranch": "feature/Sprint_162_Hotfix"
"datasource": "nuget"
"packageName": "SignZone.Enterprise.NLogFacade"
"errCode": "UNABLE_TO_VERIFY_LEAF_SIGNATURE"
}

DEBUG: Failed to look up nuget package SignZone.Enterprise.NLogFacade
{
"baseBranch": "feature/Sprint_162_Hotfix"
"dependency": "SignZone.Enterprise.NLogFacade"
"packageFile": "SignZone.FileProcess.Tests/SignZone.FileProcess.Tests.csproj"
}

[rarkins]

I'm not sure it's possible to fix this without running your own Renovate with custom certificates loaded.

httpsCertificateAuthority was added as part of this PR: #24155 so you might need to supply all three of the params added there