Intermittent failure on this error: OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint

[JasonIamAUnixAdmin]

Describe the bug

Not a consistent error.
On a GHA with 14 different steps 2 fail with OpenIDConnect provider's HTTPS certificate doesn't match configured thumbprint all use the same role to do work.

Re-running will eventually clear the error

This also happens on GHA with a single step so not related to volume of requests.

Expected Behavior

Not getting HTTPS errors

Current Behavior

Intermitent failures with the above error

Reproduction Steps

Run a job and get this error. Is intermittent. Like a host in a clusters clock is off far enough to fail a cert.

Possible Solution

No response

Additional Information/Context

No response

[JasonIamAUnixAdmin]

Could be https://github.blog/changelog/2023-06-27-github-actions-update-on-oidc-integration-with-aws/

[n1ngu]

See #669

[n1ngu]

See #357 as well

[JasonIamAUnixAdmin]

Based on above links the error message might include a hint like "Please check thumbprint"

[mrparkers]

For anyone that uses Terraform to configure their OIDC provider in AWS, this snippet may be helpful:

data "tls_certificate" "github" {
  url = "https://token.actions.githubusercontent.com/.well-known/openid-configuration"
}

resource "aws_iam_openid_connect_provider" "github" {
  url = "https://token.actions.githubusercontent.com"

  client_id_list = [
    "sts.amazonaws.com",
  ]

  thumbprint_list = [
    for c in data.tls_certificate.github.certificates : c.sha1_fingerprint
  ]
}

[n1ngu]

@mrparkers because github is serving multiple certificate chains, a single

data "tls_certificate" "github" {
  url = "https://token.actions.githubusercontent.com/.well-known/openid-configuration"
}

can't fetch them all. See #357 (comment)

[peterwoodworth]

Please see the most recent update to our readme, and please go to #357 for any further discussion related to this topic. Thanks all!

[github-actions]

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.