Gitlab-CI runner: ignore self-signed certificate

51,628

Solution 1

Based on Wassim's answer, and gitlab documentation about tls-self-signed and custom CA-signed certificates, here's to save some time if you're not the admin of the gitlab server but just of the server with the runners (and if the runner is run as root):

SERVER=gitlab.example.com
PORT=443
CERTIFICATE=/etc/gitlab-runner/certs/${SERVER}.crt

# Create the certificates hierarchy expected by gitlab
sudo mkdir -p $(dirname "$CERTIFICATE")

# Get the certificate in PEM format and store it
openssl s_client -connect ${SERVER}:${PORT} -showcerts </dev/null 2>/dev/null | sed -e '/-----BEGIN/,/-----END/!d' | sudo tee "$CERTIFICATE" >/dev/null

# Register your runner
gitlab-runner register --tls-ca-file="$CERTIFICATE" [your other options]

Update 1: CERTIFICATE must be an absolute path to the certificate file.

Update 2: it might still fail with custom CA-signed because of gitlab-runner bug #2675

Solution 2

In my case I got it working by adding the path to the .pem file as following:

sudo gitlab-runner register --tls-ca-file /my/path/gitlab/gitlab.myserver.com.pem

Often, gitlab-runners are hosted in a docker container. In that case, one needs to make sure that the tls-ca-file is available in the container.

Solution 3

Ok I followed step by step this post http://moonlightbox.logdown.com/posts/2016/09/12/gitlab-ci-runner-register-x509-error and then it worked like a charm. To prevent dead link I copy the steps below:

First edit ssl configuration on the GitLab server (not the runner)

vim /etc/pki/tls/openssl.cnf

[ v3_ca ]
subjectAltName=IP:192.168.1.1 <---- Add this line. 192.168.1.1 is your GitLab server IP.

Re-generate self-signed certificate

cd /etc/gitlab/ssl
sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/gitlab/ssl/192.168.1.1.key -out /etc/gitlab/ssl/192.168.1.1.crt
sudo openssl dhparam -out /etc/gitlab/ssl/dhparam.pem 2048
sudo gitlab-ctl restart

Copy the new CA to the GitLab CI runner

scp /etc/gitlab/ssl/192.168.1.1.crt [email protected]:/etc/gitlab-runner/certs

Thanks @Moon Light @Wassim Dhif

Solution 4

Currently there is no possibility to run the multi runner with an insecure ssl option.

There is currently an open issue at GitLab about that.

Still you should be able to get your certificate, make it a PEM file and give it to the runner command using --tls-ca-file

To craft the PEM file use openssl.
openssl x509 -in mycert.crt -out mycert.pem -outform PEM

Solution 5

The following steps worked in my environment. (Ubuntu)

Download certificate
I did not have access to the gitlab server. Therefore,

  1. Open https://some-host-gitlab.com in browser (I use chrome).
  2. View site information, usually a green lock in URL bar.
  3. Download/Export certificate by navigating to certificate information(chrome, firefox has this option)

In gitlab-runner host

  1. Rename the downloaded certificate with .crt

    $ mv some-host-gitlab.com some-host-gitlab.com.crt

  2. Register the runner now with this file

    $ sudo gitlab-runner register --tls-ca-file /path/to/some-host-gitlab.com.crt

I was able to register runner to a project.

Share:
51,628
Etienne Gautier
Author by

Etienne Gautier

Work on pythonlinuxx509dns

Updated on November 28, 2020

Comments

  • Etienne Gautier
    Etienne Gautier over 3 years
    gitlab-ci-multi-runner register
    

    gave me

    couldn't execute POST against https://xxxx/ci/api/v1/runners/register.json:
    Post https://xxxx/ci/api/v1/runners/register.json: 
    x509: cannot validate certificate for xxxx because it doesn't contain any IP SANs
    

    Is there a way to disable certification validation?

    I'm using Gitlab 8.13.1 and gitlab-ci-multi-runner 1.11.2.

  • Etienne Gautier
    Etienne Gautier about 7 years
    Thanks @wassim Dhif I also found this github.com/ayufan/gitlab-ci-multi-runner/blob/master/docs/… but still stuck..
  • MemphiZ
    MemphiZ over 5 years
    This should be the accepted answer IMHO. This is way better than recreating the certificate/dhparam and editing server configuration files.
  • MemphiZ
    MemphiZ over 5 years
    This solution also works for Windows: simply get the certificate from the server, place it in the same directory as the runner exe and add it in config.toml as "tls-ca-file" under "[[runners]]".
  • qxo
    qxo over 5 years
    command line add subjectAltName ref : security.stackexchange.com/questions/74345/… ie:-extensions san -config <(echo '[req]'; echo 'distinguished_name=req';echo '[san]'; echo 'subjectAltName=IP:192.168.101.100')
  • Majid Rajabi
    Majid Rajabi over 5 years
    What is the PORT=443?
  • liberforce
    liberforce over 5 years
    To contact your server, you need its hostname and port. Here those are just examples. Port 443 is the usual port where a web server listens for HTTPS conections.
  • Rui Pimentel
    Rui Pimentel about 5 years
    IMO the correct answer. The only explanation I judge important is on how to obtain a .PEM (or .CRT) file for the server. I did it by visiting my GitLab instance URL on Firefox, then clicked on the lock icon at the address bar, navigated to "More Information" about the connection, "Security", "View Certificate", "Details", clicked at the GitLab line at "Certificate Hierarchy", and then "Export"ed the certificate as a PEM file.
  • Alex
    Alex about 5 years
    You're a life saver!
  • Paza
    Paza almost 5 years
    This is the best answer I've encoured.
  • copeland3300
    copeland3300 over 4 years
    This worked for me, with a small tweak. I had to make sure to use the domain name that was in the cert when registering the runner, rather than the IP address alone, meaning https://gitlab.local.com vs https://10.0.0.10, even though gitlab's runner registration page listed the IP based URL. Hopefully this will be helpful to someone!
  • pangyuteng
    pangyuteng about 4 years
    i ran in to this ` x509: certificate signed by unknown authority` error, but oddly just sudo'ed during register and got past the error! sudo gitlab-runner register ....
  • Jean-Marc Amon
    Jean-Marc Amon over 2 years
    this worked for me. Thanks
  • Alex Reichman
    Alex Reichman over 2 years
    I followed all steps described above using openssl and also tried to generate ,pem flle but still getting this error ERROR: Registering runner... failed runner=VxUKPa5q status=couldn't execute POST against 172.16.53.241/api/v4/runners: Post "172.16.53.241/api/v4/runners": x509: certificate has expired or is not yet valid: current time 2022-02-13T11:58:12-05:00 is after 2022-01-28T15:25:11Z PANIC: Failed to register the runner. You may be having network problems.