Error 500 when testing web hook with untrusted ssl certificate

After upgrading to 8.0.1 our web hook started failing, when I clicked test web hook I got a 500 error. The certificate being used is not signed by a recognised certificate authority.

The web hook was: https://git.company.com/jenkins/git/notifyCommit?url=git@git.company.com:group/project.git

As a workaround I have disabled SSL verification for now.

1. An error message would be nice saying what happened.
2. How are you supposed to configure this with a certificate authority that is not in cacerts.

Error in the logs:

Completed 500 Internal Server Error in 161ms (ActiveRecord: 7.3ms)
OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed):
app/models/hooks/web_hook.rb:39:in `execute'
app/services/test_hook_service.rb:4:in `execute'
app/controllers/projects/hooks_controller.rb:28:in `test'

Tim

I have the same issue, when testing a jenkins CI hook which is using an internal CA, I see:

Completed 500 Internal Server Error in 466ms (ActiveRecord: 24.4ms)

OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed):
  app/models/hooks/web_hook.rb:39:in `execute'
  app/models/hooks/service_hook.rb:23:in `execute'
  app/models/project_services/jenkins_service.rb:20:in `execute'
  app/models/service.rb:96:in `test'
  app/controllers/projects/services_controller.rb:43:in `test'

I really don't want to disable SSL verification though...

Actually, I fixed this by looking at comments in https://gitlab.com/gitlab-org/gitlab-ci/issues/89 which had me put the CA certificate into /opt/gitlab/embedded/ssl/certs, then after a restart it worked.

Please put SSL CA certificate on machine where GitLab is installed: https://superuser.com/questions/437330/how-do-you-add-a-certificate-authority-ca-to-ubuntu

Status changed to closed

Mentioned in issue #24790 (moved)

@ayufan what's the way to do it when you use the Docker image from gitlab without creating a Dockerfile to add the certificates?

Can omnibus perform the installation for us?

OK it is possible and documented here (at least): https://gitlab.com/gitlab-org/omnibus-gitlab/blob/9-4-stable/doc/common_installation_problems/README.md#install-custom-certificate-authorities

mentioned in merge request !14785