Ssl – gitlab SSL configuration / certificate verification failed

composerlets-encryptsslssl-certificate

I have my own gitlab server, now secured with an letsencrypt SSL certificate.

Now, I want to publish some packages via packagist. But when I enter the git repository url in packagist, I got the following error message (urls changed):

Uncaught Exception: [RuntimeException] Failed to execute git clone --mirror 'https://url.de/gituser/repository.git' '/home/composer/.composer/cache/vcs/https---url.de-gituser-repository' Cloning into bare repository '/home/composer/.composer/cache/vcs/https---url.de-gituser-repository'... fatal: unable to access 'https://url.de/gituser/repository.git': server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

Each browser accepts the certificate. But not composer/packagist.

Any Ideas why?

Best Answer

Ok, I just found my mistake. I have used cert.pem instead of fullchain.pem.

Explained here: https://stackoverflow.com/questions/34189199/how-do-i-use-let-s-encrypt-with-gitlab

Related Solutions

Linux/Unix – SSL Certificate Location Guide

For system-wide use, OpenSSL should provide you /etc/ssl/certs and /etc/ssl/private. The latter of which will be restricted 700 to root:root.

If you have an application that doesn’t perform initial privilege separation from root, then it might suit you to locate them somewhere local to the application with the relevantly restricted ownership and permissions.

SSL Certificate – How to Download SSL Certificate from a Website

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect $HOST:$PORTNUMBER -servername $SERVERNAME \
    | openssl x509 > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

The -servername is used to select the correct certificate when multiple are presented, in the case of SNI.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts. The x509 at the end will strip out the intermediate certs, you will need to use sed -n '/-----BEGIN/,/-----END/p' instead of the x509 at the end.

echo -n gives a response to the server, so that the connection is released

openssl x509 removes information about the certificate chain and connection details. This is the preferred format to import the certificate into other keystores.

Best Answer

Related Solutions

Linux/Unix – SSL Certificate Location Guide

SSL Certificate – How to Download SSL Certificate from a Website

Related Topic