Gitlab代理SSL（Docker）证书验证失败

Posted 2021-03-31

我在nginx反向代理（两个docker容器）后面都有一个自托管的Gitlab omnibus安装。在浏览器中一切正常但是当我尝试克隆存储库时，我收到以下错误：

server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

Nginx配置

upstream gitlab{
  server gitlab:80;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# HTTP server to redirect all 80 traffic to SSL/HTTPS
server {
    listen 80;
    server_name ${DOMAIN_NAME};

    # Tell all requests to port 80 to be 302 redirected to HTTPS
    return 302 https://$host$request_uri;
}

server {
    listen 443;
    ssl on;

    server_name ${DOMAIN_NAME};

    ssl_certificate /etc/ssl/certs/${SSL_CERT};
    ssl_certificate_key /etc/ssl/certs/${SSL_CERT_KEY};

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_ciphers 'ECDHE-RSA-AES128...';
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_stapling on;
    ssl_stapling_verify on;
    add_header Strict-Transport-Security max-age=15768000;

    location /gitlab {
        proxy_pass http://gitlab;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_hide_header 'X-Frame-Options';
    }
}

Gitlab配置

external_url 'https://${DOMAIN_NAME}/gitlab/'
[...]
nginx['listen_port'] = 80
nginx['listen_https'] = false
nginx['ssl_ciphers'] = 'ECDHE-RSA-AES128...'
nginx['proxy_set_headers'] = {
"X-Forwarded-Proto" => "https",
"X-Forwarded-Ssl" => "on"

答案

在终端中为ubuntu运行此命令

export GIT_SSL_NO_VERIFY=1

另一答案

问题来自证书，你需要提供CA fullchain（你的浏览器不一定需要它，但curl / git / etc这样做）