由未知授权机构使用自签名证书签名的证书

I'm trying to setup a development environment where TLS is enabled for RabbitMQ. So here is what I did:

1. Use tls-gen script to generate certificates with basic profile.
2. Configure rabbitmq to use ca-certificate.pem, server-certificate.pem, and server-key.pem.
3. As I'm using MacOS, I ran sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain testca/ca_certificate.pem to add the CA certificate to the trusted roots
4. Within a Go program, I load the client_certificate.pem, and client-key.pem into a tls.Config
5. Call amqp.DialTLS().

I got the following error message:

 err: x509: certificate signed by unknown authority

which is unexpected. In step 4 above, if I add the ca-certificate.pem into the root CAs of the tls.Config, it works fine. So I'm suspecting that the addition of the root ca macOS is not right.

Can somebody review the above and point out my mistake?