x509: certificate signed by unknown authority? Maybe the cert pool is empty

I recently worked on getting amazon-ssm-agent to run inside containers on Bottlerocket. During that process, I ran into a TLS issue connecting to amazonaws.com. The root cause turned out be interesting and we'll walk through it in this post. Running amazon-ssm-agent in a container: why and how? To enable sessions between a container and the outside world, we followed the same approach as the ECS…