How to Update Third-Party SSL Certificates on GitLab

Updating third-party SSL certificates on GitLab involves replacing the existing certificate files with the new ones and reconfiguring GitLab. Here’s how to do it

1. Obtain New SSL Certificates

You can use my CSR Generator to generate a CSR and acquire the SSL certificate.

– Acquire the updated SSL certificate and private key from your Certificate Authority (CA).
– Save them on your server in a secure location. For example:

• /etc/gitlab/ssl/yourdomain.com.crt (certificate)
• /etc/gitlab/ssl/yourdomain.com.key (private key)
• /etc/gitlab/ssl/yourdomain.com.ca-bundle (optional, CA bundle if required by your CA)

Ensure the files are owned by root and have appropriate permissions:

sudo chown root:root /etc/gitlab/ssl/yourdomain.com.*
sudo chmod 600 /etc/gitlab/ssl/yourdomain.com.*

2. Update GitLab Configuration

Open the GitLab configuration file for editing:

sudo nano /etc/gitlab/gitlab.rb

Set the external_url to use HTTPS if not already configured:

external_url 'https://yourdomain.com'

If you’re using GitLab’s bundled NGINX, update its SSL settings:

nginx['ssl_certificate'] = "/etc/gitlab/ssl/yourdomain.com.crt"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/yourdomain.com.key"
nginx['ssl_dhparam'] = "/etc/gitlab/ssl/dhparam.pem" # Optional

3. Reconfigure GitLab

Apply the changes and reload GitLab:

sudo gitlab-ctl reconfigure

4. Restart GitLab Services

Restart NGINX and other GitLab services:

sudo gitlab-ctl restart

5. Verify the SSL Certificate

Open your GitLab instance in a browser at https://yourdomain.com and confirm the SSL certificate is updated.

6. Optional: Test SSL Configuration

Use tools like SSL Labs’ SSL Test to verify the SSL configuration.

Troubleshooting

• Permissions Issues: Ensure certificate files have correct permissions and ownership.
• NGINX Errors: Check logs if NGINX fails to restart:

  sudo gitlab-ctl tail nginx/gitlab_error.log