Nicolas B. - gitlab
Nicolas B., Ruby Backend Developer
Zola
2026-05-23T00:00:00+00:00
https://nicolas-brousse.fr/tags/gitlab/atom.xml
Use Let's Encrypt on GitLab
2016-05-30T00:00:00+00:00
2026-05-23T00:00:00+00:00
Nicolas B.
https://nicolas-brousse.fr/articles/2016-05-30-letsencrypt-on-gitlab/
<img src="https://nicolas-brousse.fr/processed_images/banner.bc33cbff30c91434.jpg" alt=""
data-zoomable="true" data-zoom-src="https://nicolas-brousse.fr/processed_images/banner.bc33cbff30c91434.jpg"
width="1280" height="512"
sizes="(min-width: 920px) 784px, (min-width: 700px) calc(82vw + 46px), calc(100vw - 40px)"
srcset="https://nicolas-brousse.fr/processed_images/banner.be49630101452512.jpg 640w,
https://nicolas-brousse.fr/processed_images/banner.80bb597fba51ede0.jpg 784w,
https://nicolas-brousse.fr/processed_images/banner.617981ec50c02724.jpg 1280w,
https://nicolas-brousse.fr/processed_images/banner.31b3bee1f0e7284b.jpg 1920w"
loading="lazy">
<blockquote class="markdown-alert-warning">
<p>This is directly managed by GitLab since version <code>10.5</code>.</p>
</blockquote>
<p>If you have a <a rel="noopener noreferrer external" target="_blank" href="https://about.gitlab.com/">GitLab</a> instance and you want to secure it, you could do it for free with <a rel="noopener noreferrer external" target="_blank" href="https://letsencrypt.org/">Let’s Encrypt</a>.</p>
<hr />
<p>To start if it’s not already the case you need to <a rel="noopener noreferrer external" target="_blank" href="https://letsencrypt.org/getting-started/">install Let’s Encrypt</a>.</p>
<p>When installation is done we create an ini file for Let’s Encrypt. It’s more clear than a command line with multiple options.<br />
So create <code>/root/letsencrypt-config/gitlab.ini</code> file.</p>
<pre class="giallo" style="color-scheme: light dark; color: light-dark(#4C4F69, #CDD6F4); background-color: light-dark(#EFF1F5, #1E1E2E);"><code data-lang="ini"><span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 1</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;">#</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;"> Let's Encrypt config file for GitLab instance</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 2</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 3</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;">#</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;"> register certs with the following email address</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 4</span><span style="color: light-dark(#1E66F5, #89B4FA);">email</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span> hello@MY_DOMAIN</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 5</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 6</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;">#</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;"> standalone authenticator</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 7</span><span style="color: light-dark(#1E66F5, #89B4FA);">authenticator</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span> standalone</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 8</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 9</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">10</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;">#</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;"> generate certificates for the specified domains.</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">11</span><span style="color: light-dark(#1E66F5, #89B4FA);">domains</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span> gitlab.MY_DOMAIN, mattermost.MY_DOMAIN, registry.MY_DOMAIN</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">12</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">13</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;">#</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;"> use a 4096 bit RSA key</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">14</span><span style="color: light-dark(#1E66F5, #89B4FA);">rsa-key-size</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span> 4096</span></span></code></pre>
<p>We use <code>authenticator = standalone</code> because of GitLab Registry. The Registry can’t be started in <code>http://</code>. So it’s the more easier. But it will need to have <code>nginx</code> down while Let’s Encrypt run.</p>
<p>Now we have to create a small script <code>/root/letsencrypt-config/renew-ssl-certificates.cron</code> to automatically renew certificates by using cron.<br />
The script will stop the GitLab’s <code>nginx</code> server, then call Let’s Encrypt to renew our certificates, then start the <code>nginx</code> server.</p>
<pre class="giallo" style="color-scheme: light dark; color: light-dark(#4C4F69, #CDD6F4); background-color: light-dark(#EFF1F5, #1E1E2E);"><code data-lang="shellscript"><span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">1</span><span style="color: light-dark(#EA76CB, #F5C2E7);font-style: italic;">#!</span><span style="color: light-dark(#EA76CB, #F5C2E7);font-style: italic;">/bin/bash</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">2</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">3</span><span style="color: light-dark(#1E66F5, #89B4FA);font-style: italic;">gitlab-ctl</span><span style="color: light-dark(#40A02B, #A6E3A1);"> stop</span><span style="color: light-dark(#40A02B, #A6E3A1);"> nginx</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">4</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">5</span><span style="color: light-dark(#1E66F5, #89B4FA);font-style: italic;">/usr/local/bin/certbot-auto</span><span style="color: light-dark(#40A02B, #A6E3A1);"> certonly</span><span style="color: light-dark(#40A02B, #A6E3A1);"> -</span><span style="color: light-dark(#40A02B, #A6E3A1);">c</span><span style="color: light-dark(#40A02B, #A6E3A1);"> /root/letsencrypt-config/gitlab.ini</span><span style="color: light-dark(#40A02B, #A6E3A1);"> -</span><span style="color: light-dark(#40A02B, #A6E3A1);">-renew-by-default</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">6</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">7</span><span style="color: light-dark(#1E66F5, #89B4FA);font-style: italic;">gitlab-ctl</span><span style="color: light-dark(#40A02B, #A6E3A1);"> start</span><span style="color: light-dark(#40A02B, #A6E3A1);"> nginx</span></span></code></pre>
<p>Then we put the script into <code>cron.monthly</code>. And manually generate certificates the first time.</p>
<pre class="giallo" style="color-scheme: light dark; color: light-dark(#4C4F69, #CDD6F4); background-color: light-dark(#EFF1F5, #1E1E2E);"><code data-lang="shellscript"><span class="giallo-l"><span style="color: light-dark(#1E66F5, #89B4FA);font-style: italic;">$</span><span style="color: light-dark(#40A02B, #A6E3A1);"> chmod</span><span style="color: light-dark(#40A02B, #A6E3A1);"> +x</span><span style="color: light-dark(#40A02B, #A6E3A1);"> /root/letsencrypt-config/renew-ssl-certificates.cron</span></span>
<span class="giallo-l"><span style="color: light-dark(#1E66F5, #89B4FA);font-style: italic;">$</span><span style="color: light-dark(#40A02B, #A6E3A1);"> ln</span><span style="color: light-dark(#40A02B, #A6E3A1);"> -</span><span style="color: light-dark(#40A02B, #A6E3A1);">s</span><span style="color: light-dark(#40A02B, #A6E3A1);"> /root/letsencrypt-config/renew-ssl-certificates.cron</span><span style="color: light-dark(#40A02B, #A6E3A1);"> /etc/cron.monthly/</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;">#</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;"> Let's generate the certificates for the first time</span></span>
<span class="giallo-l"><span style="color: light-dark(#1E66F5, #89B4FA);font-style: italic;">$</span><span style="color: light-dark(#40A02B, #A6E3A1);"> /usr/local/bin/certbot-auto</span><span style="color: light-dark(#40A02B, #A6E3A1);"> certonly</span><span style="color: light-dark(#40A02B, #A6E3A1);"> -</span><span style="color: light-dark(#40A02B, #A6E3A1);">c</span><span style="color: light-dark(#40A02B, #A6E3A1);"> /root/letsencrypt-config/gitlab.ini</span></span></code></pre>
<p>To finish we configure GitLab to have it use the certificates.</p>
<pre class="giallo" style="color-scheme: light dark; color: light-dark(#4C4F69, #CDD6F4); background-color: light-dark(#EFF1F5, #1E1E2E);"><code data-lang="ruby"><span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 1</span><span>external_url </span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">https://...</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 2</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 3</span><span>nginx</span><span style="color: light-dark(#7C7F93, #9399B2);">[</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">redirect_http_to_https</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#7C7F93, #9399B2);">]</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span style="color: light-dark(#FE640B, #FAB387);"> true</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 4</span><span>nginx</span><span style="color: light-dark(#7C7F93, #9399B2);">[</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">ssl_certificate</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#7C7F93, #9399B2);">]</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span style="color: light-dark(#40A02B, #A6E3A1);"> "</span><span style="color: light-dark(#40A02B, #A6E3A1);">/etc/letsencrypt/live/gitlab.MY_DOMAIN/fullchain.pem</span><span style="color: light-dark(#40A02B, #A6E3A1);">"</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 5</span><span>nginx</span><span style="color: light-dark(#7C7F93, #9399B2);">[</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">ssl_certificate_key</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#7C7F93, #9399B2);">]</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span style="color: light-dark(#40A02B, #A6E3A1);"> "</span><span style="color: light-dark(#40A02B, #A6E3A1);">/etc/letsencrypt/live/gitlab.MY_DOMAIN/privkey.pem</span><span style="color: light-dark(#40A02B, #A6E3A1);">"</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 6</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 7</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;">#</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;"> ...</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 8</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);"> 9</span><span>mattermost_external_url </span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">https://...</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">10</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">11</span><span>mattermost_nginx</span><span style="color: light-dark(#7C7F93, #9399B2);">[</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">redirect_http_to_https</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#7C7F93, #9399B2);">]</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span style="color: light-dark(#FE640B, #FAB387);"> true</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">12</span><span>mattermost_nginx</span><span style="color: light-dark(#7C7F93, #9399B2);">[</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">ssl_certificate</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#7C7F93, #9399B2);">]</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span style="color: light-dark(#40A02B, #A6E3A1);"> "</span><span style="color: light-dark(#40A02B, #A6E3A1);">/etc/letsencrypt/live/gitlab.MY_DOMAIN/fullchain.pem</span><span style="color: light-dark(#40A02B, #A6E3A1);">"</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">13</span><span>mattermost_nginx</span><span style="color: light-dark(#7C7F93, #9399B2);">[</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">ssl_certificate_key</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#7C7F93, #9399B2);">]</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span style="color: light-dark(#40A02B, #A6E3A1);"> "</span><span style="color: light-dark(#40A02B, #A6E3A1);">/etc/letsencrypt/live/gitlab.MY_DOMAIN/privkey.pem</span><span style="color: light-dark(#40A02B, #A6E3A1);">"</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">14</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">15</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;">#</span><span style="color: light-dark(#7C7F93, #9399B2);font-style: italic;"> ...</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">16</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">17</span><span>registry_external_url </span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">https://...</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">18</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">19</span><span>registry_nginx</span><span style="color: light-dark(#7C7F93, #9399B2);">[</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">ssl_certificate</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#7C7F93, #9399B2);">]</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span style="color: light-dark(#40A02B, #A6E3A1);"> "</span><span style="color: light-dark(#40A02B, #A6E3A1);">/etc/letsencrypt/live/gitlab.MY_DOMAIN/fullchain.pem</span><span style="color: light-dark(#40A02B, #A6E3A1);">"</span></span>
<span class="giallo-l"><span aria-hidden="true" class="giallo-ln" style="color: light-dark(#8C8FA1, #7F849C);">20</span><span>registry_nginx</span><span style="color: light-dark(#7C7F93, #9399B2);">[</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#40A02B, #A6E3A1);">ssl_certificate_key</span><span style="color: light-dark(#40A02B, #A6E3A1);">'</span><span style="color: light-dark(#7C7F93, #9399B2);">]</span><span style="color: light-dark(#179299, #94E2D5);"> =</span><span style="color: light-dark(#40A02B, #A6E3A1);"> "</span><span style="color: light-dark(#40A02B, #A6E3A1);">/etc/letsencrypt/live/gitlab.MY_DOMAIN/privkey.pem</span><span style="color: light-dark(#40A02B, #A6E3A1);">"</span></span></code></pre>
<p>And apply it.</p>
<pre class="giallo" style="color-scheme: light dark; color: light-dark(#4C4F69, #CDD6F4); background-color: light-dark(#EFF1F5, #1E1E2E);"><code data-lang="shellscript"><span class="giallo-l"><span style="color: light-dark(#1E66F5, #89B4FA);font-style: italic;">$</span><span style="color: light-dark(#40A02B, #A6E3A1);"> gitlab-ctl</span><span style="color: light-dark(#40A02B, #A6E3A1);"> reconfigure</span></span></code></pre>
<p>Enjoy HTTPS on your GitLab instance :)</p>
<hr />
<p>Sources:</p>
<ul>
<li><a rel="noopener noreferrer external" target="_blank" href="https://webnugget.de/setting-up-gitlab-with-free-ssl-certs-from-lets-encrypt-on-ubuntu-14-04/">webnugget.de/setting-up-gitlab-with-free-ssl-certs-from-lets-encrypt-on-ubuntu-14-04/</a></li>
</ul>