I have a self-hosted Gitlab omnibus installation behind a Nginx reverse proxy (both docker container). Everything works fine in the browser however when I try to clone a repository I get the following error:
server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none
Nginx config
upstream gitlab{
server gitlab:80;
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
# HTTP server to redirect all 80 traffic to SSL/HTTPS
server {
listen 80;
server_name ${DOMAIN_NAME};
# Tell all requests to port 80 to be 302 redirected to HTTPS
return 302 https://$host$request_uri;
}
server {
listen 443;
ssl on;
server_name ${DOMAIN_NAME};
ssl_certificate /etc/ssl/certs/${SSL_CERT};
ssl_certificate_key /etc/ssl/certs/${SSL_CERT_KEY};
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers 'ECDHE-RSA-AES128...';
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;
location /gitlab {
proxy_pass http://gitlab;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_hide_header 'X-Frame-Options';
}
}
Gitlab config
external_url 'https://${DOMAIN_NAME}/gitlab/'
[...]
nginx['listen_port'] = 80
nginx['listen_https'] = false
nginx['ssl_ciphers'] = 'ECDHE-RSA-AES128...'
nginx['proxy_set_headers'] = {
"X-Forwarded-Proto" => "https",
"X-Forwarded-Ssl" => "on"
在终端上为ubuntu运行此命令
export GIT_SSL_NO_VERIFY=1
问题出在证书上,您需要提供CA fullchain(您的浏览器不一定需要它,但是curl / git / etc可以)
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.