gitlab-runner cannot clone due to expired root certificate – Debian

This is a problem on the server side, and it needs to be fixed by replacing the chain of CA certificates.

Because Sectigo knew that this root certificate would expire soon, several years ago, they created a new root certificate and registered it with all the major browser vendors and OS manufacturers. However, because many older systems don’t upgrade their certificates, this new root CA was signed by an older CA, a process called cross-signing. This allows people to use the new root for issuing certificates yet remain compatible with older systems.

Any systems on the Internet today can no longer handle the legacy root because it’s now expired, so there’s no benefit to using it anymore.

Some TLS libraries can figure out that a certificate chains to a trusted root and ignore the extra, expired root certificates, but some cannot. As a result, the fact that you have the old AddTrust External Root CA certificate in your certificate chain can break some of those TLS libraries, which is what’s happening here.

Sectigo has documentation on this issue. You want to remove the AddTrust CA certificate and make sure that the UserTrust or COMODO root that you’re using is self-signed. If you’re using a Debian or Ubuntu system, you may be able to find the appropriate root certificate in /etc/ssl/certs.

Even better, you can just remove the root certificate altogether and only include intermediates, since the root certificate isn’t actually needed when creating the TLS connection, since the client must already have it.