Self-signed certificates or custom Certification Authorities
Introduced in GitLab Runner 0.7.0
GitLab Runner allows you to configure certificates that are used to verify TLS peers when connecting to the GitLab server.
This solves the x509: certificate signed by unknown authority
problem when registering a runner.
Supported options for self-signed certificates
GitLab Runner supports the following options:
-
Default: GitLab Runner reads the system certificate store and verifies the GitLab server against the certificate authorities (CA) stored in the system.
-
GitLab Runner reads the PEM certificate (DER format is not supported) from a predefined file:
-
/etc/gitlab-runner/certs/hostname.crt
on *nix systems when GitLab Runner is executed as root. -
~/.gitlab-runner/certs/hostname.crt
on *nix systems when GitLab Runner is executed as non-root. -
./certs/hostname.crt
on other systems. If running Runner as a Windows service, this will not work. Use the last option instead.
If your server address is:
https://my.gitlab.server.com:8443/
, create the certificate file at:/etc/gitlab-runner/certs/my.gitlab.server.com.crt
.Note: You may need to concatenate the intermediate and server certificate for the chain to be properly identified. -
-
GitLab Runner exposes the
tls-ca-file
option during registration (gitlab-runner register --tls-ca-file=/path
), and inconfig.toml
under the[[runners]]
section. This allows you to specify a custom certificate file. This file will be read every time the runner tries to access the GitLab server.
Git cloning
The runner injects missing certificates to build the CA chain in build containers.
This allows git clone
and artifacts
to work with servers that do not use publicly
trusted certificates.
This approach is secure, but makes the runner a single point of trust.
Help and feedback
If there's something you don't like about this feature
To propose functionality that GitLab does not yet offer
To further help GitLab in shaping new features
If you didn't find what you were looking for
If you want help with something very specific to your use case, and can use some community support
POST ON GITLAB FORUM
If you have problems setting up or using this feature (depending on your GitLab subscription)
REQUEST SUPPORT
To view all GitLab tiers and features or to upgrade
If you want to try all features available in GitLab.com
If you want to try all features available in GitLab self-managed
If you spot an error or a need for improvement and would like to fix it yourself in a merge request
EDIT THIS PAGE
If you would like to suggest an improvement to this doc