PR_END_OF_FILE_ERROR for self-signed SSL certificate in GitLab - Ubuntu

TL;DR

Below is the code I used to successfully run a self-hosted instance of GitLab over https://localhost:443 using self-signed SSL certificates:

GitLab

The GitLab instance can be installed with:

sudo apt install git -y
mkdir git
cd git
git clone https://github.com/TruCol/Self-host-GitLab-CI-for-GitHub.git
cd Sel*
git checkout https
./install_gitlab.sh 
 --server 
 --gitlab-email [email protected] 
 --gitlab-password 
 --labprereq 
 --external-url "https://0.0.0.0" 
 --gitlab-server "0.0.0.0"

SSL

The self-signed SSL certificates for the onion domains (and localhost) for GitLab can be created with:

git clone https://github.com/HiveMinds/SSL4Tor.git
cd SSL4Tor
./src/main.sh 
  --1-domain-1-service 
  --delete-onion-domain 
  --services 443:gitlab:443/22:ssh:22 
  --make-onion-domains 
  --ssl-password somepassword 
  --background-dash 
  --make-ssl-certs 
  --setup-ssh-server 
  --get-onion-domain

Add self-signed SSL cert into GitLab

Next, those SSL-certificates can be automatically added to GitLab, and GitLab is automatically reconfigured with:

./src/main.sh -1d1s --services 80:gitlab:443 --apply-certs

Next, one should be able to visit GitLab at https://localhost:443

Nginx Settings

The settings below were found to be working nginx settings:

## GitLab configuration settings
external_url 'https://localhost'
letsencrypt['enable'] = false
nginx['enable'] = true
nginx['redirect_http_to_https'] = true
nginx['ssl_certificate'] = "/etc/gitlab/ssl/localhost/public_key.pem"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/localhost/private_key.pem"
nginx['listen_port'] = 443
nginx['listen_https'] = true

Note the root ca certificate (neither public nor private cert/key) is not added/given to GitLab

Initial Errors

To explain what I did wrong, and how the accepted answer led me to a working configuration, the following content of that answer is parsed and discussed:

.pem files vs .crt and .key file.

About renaming .pem files to .crt and .key - for unix systems this doesn't really matter, since they're all just regular text files anyway, but for the sake of accuracy, I'd change the extensions.

I assume there indeed should not be a difference between the content of the public.pem and public.crt file, nor between private.pem and private.key. I verified the two files were the same. However, when copying the private.key into the docker, the content got scrambled, I do not exactly know how at this time. In the end, I used the .pem files, because that allowed me to remove the step of converting the .pem files into .crt and .key respectively.

Nginx able to read SSL files?

Did you make sure that the cert files are readable by nginx inside the container? Check the permissions. I got a permission error when I tried to read the content of one of the .pem files within the docker shell. I falsely assumed this meant nginx was not able to read the SSL certs. Later I wrote a method to verify the SSL certs that were copied inside the docker, are valid. At that point, no read error occurred. I did not explicitly verify nginx was able to read the SSL files, as I did not know how.

Which port to make nginx listen to

Listening on port 80 in your config should be fine, there's probably a bit of configuration inside nginx website config file (usually in /etc/nginx/sites-enabled/*) that redirects https traffic from port 80 to 443 automatically.

This was the last bit of information I applied to get it working. I changed the port in the nginx settings in the gitlab.rb file from port 80 to port 443 and then it worked.

Make nginx listen to https

You should definitely enable https in your config. Maybe this will be enough to get your gitlab running on https.

That was True, I did not do that. Making nginx listen to https.

External url name for GitLab

The EXTERNAL_URL envvar inside your docker config is "https://127.0.0.1" - this usually only allows users from localhost to view the website. To allow traffic from "everywhere", change this to "https://0.0.0.0" (check gitlab docker documentation first)

I was unaware of the difference between 0.0.0.0 and 127.0.0.1 thank you for explaining that. Changing that has helped, I expect it will also be valuable when running GitLab as an onion service. I do not yet know how to run GitLab on multiple external urls (neither for the docker run command to start GitLab, nor for the nginx settings.).

How to access GitLab locally

You're trying to access the website through https protocol, but on port 80. In most default configs, this will not work, as port 80 is reserved for http, and port 443 for https traffic.

Yes, after switching the nginx settings from port 80 to port 443, I was able to visit GitLab locally at https://0.0.0.0:443.

A bunch of thoughts:

About renaming .pem files to .crt and .key – for unix systems this doesn’t really matter, since they’re all just regular text files anyway, but for the sake of accuracy, I’d change the extensions.
Did you make sure that the cert files are readable by nginx inside the container? Check the permissions.
Listening on port 80 in your config should be fine, there’s probably a bit of configuration inside nginx website config file (usually in /etc/nginx/sites-enabled/*) that redirects https traffic from port 80 to 443 automatically.

You should definitely enable https in your config. Maybe this will be enough to get your gitlab running on https.

 nginx['ssl_certificate'] = "/etc/gitlab/ssl/localhost/public_key.crt"
 nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/localhost/private_key.key"
 nginx['listen_port'] = 80
 nginx['listen_https'] = true

The EXTERNAL_URL envvar inside your docker config is "https://127.0.0.1" – this usually only allows users from localhost to view the website. To allow traffic from "everywhere", change this to "https://0.0.0.0" (check gitlab docker documentation first)
Docker ports 80 and 443 must of course be exposed
You’re trying to access the website through https protocol, but on port 80. In most default configs, this will not work, as port 80 is reserved for http, and port 443 for https traffic.

Try these links:

http://localhost
http://localhost:80
https://localhost
https://localhost:443

If none of the above solve your error, try accessing the website through another browser, as the error you’re mentioning seems to be firefox-specific.

PR_END_OF_FILE_ERROR for self-signed SSL certificate in GitLab – Ubuntu

Issue

Verification

Details

Question

Approach

MWE

Qemu

GitLab

SSL

Add self-signed SSL cert into GitLab

Answers

TL;DR

GitLab

SSL

Add self-signed SSL cert into GitLab

Nginx Settings

Initial Errors

.pem files vs .crt and .key file.

Nginx able to read SSL files?

Which port to make nginx listen to

Make nginx listen to https

External url name for GitLab

How to access GitLab locally