I’m trying to build a GitLab server with build pipelines. I have already installed GitLab with Docker and created several runners. Now I want to connect the runners to the GitLab, but I keep getting the error message: tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead
These are my steps to generate the certificates:
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=DE/ST=BW/O=Example Company/CN=GitLab CA"
openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr -subj "/C=DE/ST=Baden-Wüttemberg/L=Mannheim/O=Example/OU=IT Dept/CN=gitlab.local" -addext "subjectAltName = DNS:localhost,DNS:gitlab.local"
openssl x509 -req -in server.csr -out server.crt -days 3650 -CA ca.crt -CAkey ca.key -CAcreateserial
My registration command : docker exec -it gitlab-runner-1 gitlab-runner register --url https://gitlab.local --token glrt-v8Cjr4ZaVQGKnnws7tAx --tls-ca-file /etc/gitlab-runner/ssl/ca.crt
I gave the server.crt
and server.key
files to the GitLab server and I made the ca.crt
known to the GitLab runner.
Unfortunately, I still get the error even though I entered the domain name correctly with SAN. Does somebody has any idea? Thanks.
For completeness, here is my Docker Compose file:
version: '3.8'
services:
gitlab:
image: gitlab/gitlab-ee:latest
container_name: gitlab
restart: always
hostname: 'gitlab.local'
environment:
GITLAB_OMNIBUS_CONFIG: |
external_url 'https://gitlab.example.de'
gitlab_rails['gitlab_shell_ssh_port'] = 2222
networks:
- internal-services
- gitlab-runner-network
volumes:
- '/docker-volumes/gitlab/config:/etc/gitlab'
- '/docker-volumes/gitlab/logs:/var/log/gitlab'
- '/docker-volumes/gitlab/data:/var/opt/gitlab'
shm_size: '256m'
gitlab-runner-1:
image: gitlab/gitlab-runner:latest
container_name: gitlab-runner-1
hostname: gitlab-runner-1.local
restart: always
networks:
- gitlab-runner-network
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /docker-volumes/gitlab-runner/config-1:/etc/gitlab-runner
networks:
internal-services:
external: true
gitlab-runner-network:
external: true
I tried these solution without success:
how to solve this errror “certificate relies on legacy Common Name field, use SANs instead” during gitlab runner registration?