Unable to set issuer certificate when using SSL and Docker executor

Check that you send a full certificate chain from your webserver. This error usually indicates that there's missing intermediate.

You can use ssllabs.com to test that.

Added support label

Milestone changed to v1.1

Unfortunatly I can't use the Website cause my server is only available from inside my institution's network. Instead I tried the following:

openssl s_client -connect myserver.org:10443 -CAfile ca.crt

And got:

---
No client certificate CA names sent
---
SSL handshake has read 1870 bytes and written 456 bytes
---
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : AES256-SHA
    Session-ID: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    Session-ID-ctx: 
    Master-Key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    Key-Arg   : None
    Start Time: 1456846244
    Timeout   : 300 (sec)
    Verify return code: 0 (ok)
---
´´´
The certificate chain seems to be ok though.
Is there probably more to do than just put ca.crt into the runners /etc/gitlab-runner/certs folder?

Might it be possible that the docker image (in my case java:latest) linked to the runner may need the certificate chain as well?

I can register my runner properly. The failure comes up during project build.

I'm wondering if the docker java:latest image lack of finding the right ca-certificate may throw this error ...

Is there any way of checking this? Or is is there any possibility to forward the certificate to the image?

@kungru We try to inject the certificate chain to docker container :)

Sounds great!!

mentioned in issue #1300 (closed)

@dielfe Is the issue still actual?

Added waiting for feedback label

@tmaczukin Hi, I'm not a topic starter, but I have this problem for quite a time. I see that error a lot with Github (not Gitlab) repos, both on Windows and Arch Linux. For example see this Windows build, where Haskell tool stack tries to run git fetch on a Github repo. Or this Linux build, where the script just runs git submodule update. The second link is of private project, so I copy the lines from the log here:

Fetching submodule deps/flaw
fatal: unable to access 'https://github.com/quyse/flaw.git/': SSL certificate problem: unable to get local issuer certificate

According to my observations it always happens when the build script runs non-trivial git fetch with a non-gitlab remote repo. git clone is OK though for any repo. The strange thing is that simply re-running the build second time always works without problems. So I'm not sure if git itself is not containing some bug, looks like first git fetch successfully updates working directory (but prints out an error), and at second time it successfully doesn't do anything, and build can run further.

If that matters, I'm running my own VMs with runners in shell mode, with reasonably fresh gitlab-ci-multi-runner (last time updated like two weeks ago).

I made an experiment a few times: I logged into VM and performed appropriate git fetch manually in a runner's working directory before build - it was always successful as you may expect (so git working directory is itself fine), and the build triggered via Gitlab runs fine afterwards. But if I do not run git fetch manually, build triggered via Gitlab stumbles. So, for me it definitely looks like this injecting of certificate is doing something wrong.

I have an intermittent issue similar to @quyse 's description that I reported here. Also from GitHub, also seems to go away the second time, also on Linux x64.

@quyse @drewcrawford Thank you for comments. I'll try to debug what can be the cause of this problem.

Reassigned to @tmaczukin

mentioned in issue #1283 (closed)

The same is happening to me: "Unable to get issuer certificate"

We have our own private CA and ca.crt is placed in config/certs
openssl s_client is able to verify the connection to our gitlab server
Using docker executor: is unable to clone repository
If I try the same command the executor does, I can clone the repo: GIT_SSL_CAINFO=path/to/ca.crt git clone myrepourlwithtoken

Status changed to closed

I'm going to close this as a duplicate of #1283 (closed) - @robejrm @kungru can you review that and !299 (merged) ? Feel free to reopen if you disagree :)

The same problem:

Running with gitlab-runner 10.0.1 (e991d1b4)
  on MyProject Docker Runner (3e785ab6)
Using Docker executor with image node:alpine ...
Using docker image sha256:3bdf3f442dab372f265664d441cb37483c2163acd2d1f96a84b16933336aec8b for predefined container...
Pulling docker image node:alpine ...
Using docker image node:alpine ID=sha256:b7e15c83cdaf2bf47a6db862f342d8d176477e54cc271b0803e0f1c7273cd5a7 for build container...
Running on runner-3e785ab6-project-67-concurrent-0 via e92f04999e55...
Cloning repository...
Cloning into '/builds/myproj'...
fatal: unable to access 'https://gitlab-ci-token:xxxxxxxxxxxxxxxxxxxx@gitlab.mycomplany.com/myproj.git/': SSL certificate problem: unable to get issuer certificate
ERROR: Job failed: exit code 1

I'm using docker executor, self-signed certificate. I am able to register a runner, tried shell executor - it works, but docker executor cannot clone repository.

Unable to set issuer certificate when using SSL and Docker executor

Designs

Child items ...

Activity

Admin message

Admin message

Unable to set issuer certificate when using SSL and Docker executor

Activity