gitlab-runner and SSL certificates

Hello, I've installed gitlab via the omnibus package on Digital Ocean. Recently I've purchased SSL certificate an installed it successfully for GitLab. But now all my runners aren't working. When I try to re-register them I get the following error:

x509: certificate signed by unknown authority

I've done quick search that pointed me to copy the certificate to /etc/gitlab-runner/certs/ca.crt. I've done this and re-configured gitlab via gitlab-cli reconfigure but still I get the same error.

Any tips&tricks how to get this working?

Thanks!

I haven't attempted this myself yet but from my experience this just means that the certificate chain is not complete on the system, thus your certificate cannot be verified.

CERTURL needs to be the combined chain or you can do it twice or more if you have multiple intermediate certs that are needed

export CERTURL=https://www.digicert.com/CACerts/DigiCertSHA2ExtendedValidationServerCA.crt
grep '^ID=' /etc/os-release |grep -iE 'fedora|centos|redhat' && wget $CERTURL -O /etc/pki/ca-trust/source/anchors/gitlab-ca-chain.crt.pem && update-ca-trust enable && update-ca-trust extract
grep '^ID=' /etc/os-release |grep -iE 'ubuntu|debian' && wget $CERTURL -O /usr/local/share/ca-certificates/gitlab-ca-chain.crt.pem && update-ca-certificates \
cat /usr/local/share/ca-certificates/gitlab-ca-chain.crt.pem >> /etc/ssl/certs/ca-certificates.crt

mentioned in issue #267 (closed)

Hi there, I had the same issue and managed to solve it, see here: https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/issues/267#note_2668095

The support for self-signed certificates is in Bleeding Edge release. It should be live in 0.7.0.

Please check the docs: https://gitlab.com/gitlab-org/gitlab-ci-multi-runner/blob/master/docs/configuration/tls-self-signed.md

Status changed to closed

Reassigned to @ayufan

Milestone changed to v0.7.0

Hi folks,

I have followed the instructions above and I cannot register a new runner. I suspect this is because I need 2 certificates for the verification to succeed: (1) a host certificate, and (2) a root signing certificate, singing the host certificate. Both of these two must be verified for the verification to work and even though I copy both the host and the signing certificate to the paths suggested above, the verification still fails.

I'm trying to set this up behind a company firewall, i.e., bot the server and and the runner are behind the firewall, and verifying certificates makes not much sense, especially when this ends up in a complete showstopper.

I really would like a command-line argument to bypass all verification of the certificate. Is that feasible? If there is something I'm missing with the setup above, please point me to how I can debug this.

Thanks.