Let’s Encrypt SSL for GitLab

To enable Let’s Encrypt SSL for GitLab, follow these steps. Ensure that GitLab is configured properly and you have root access to your GitLab instance. The steps apply to GitLab’s Omnibus installation.

1. Ensure Prerequisites

• A publicly accessible domain name pointing to your GitLab server.
• Port 80 (HTTP) and port 443 (HTTPS) open on your server’s firewall.
• Root or sudo privileges on the GitLab server.

2. Edit GitLab Configuration

Open the GitLab configuration file for editing:

sudo nano /etc/gitlab/gitlab.rb

Locate and set the following configurations:

• Enable HTTPS:

  external_url 'https://yourdomain.com'

• Enable Let’s Encrypt integration:

  letsencrypt['enable'] = true
  letsencrypt['contact_emails'] = ['your-email@example.com'] # Optional, but recommended
  letsencrypt['auto_renew'] = true # Optional, renews automatically

• If you are behind a reverse proxy, you may need to configure nginx['listen_port'] or proxy settings accordingly.

3. Reconfigure GitLab

Apply the changes by running:

sudo gitlab-ctl reconfigure

During this process:

• GitLab will automatically request and configure a Let’s Encrypt certificate.
• If successful, HTTPS will be enabled on your GitLab instance.

4. Check the SSL Certificate

Access your GitLab instance in a browser at https://yourdomain.com and verify that the SSL certificate is properly issued by Let’s Encrypt.

5. Optional: Test Auto-Renewal

To test auto-renewal:

sudo gitlab-rake gitlab:lets_encrypt:renew

Monitor the logs to confirm renewal:

sudo gitlab-ctl tail nginx/gitlab_error.log