To retire the warning, teach your machine the anchor. The root is served on an open endpoint:
curl -sk https://127.0.0.1:8081/infra/trust -o goca-infra.pem
Import that file into your OS or browser trust store, or point tools at it directly (curl --cacert goca-infra.pem …).
Two details save you a support ticket. First, /infra/trust serves the self-signed root — subject equals issuer — and that is the file to import, not the issuing CA: importing ica-infra leaves the chain ending at an anchor nothing trusts. Second, on Windows the root belongs in Trusted Root Certification Authorities, not Enterprise Trust — that store holds certificate trust lists and is never consulted for chain building.
There is a second way to make the warning disappear, for later: re-bind goca-service-tls to a CA your clients already trust. Frame 20 does exactly that.
Now I can fetch the infra root and put it in the store that actually gets consulted.