Skip to content

Support for Mutual TLS

Av1o requested to merge av1o/gitlab-pages:mtls into master

What does this MR do?

At my organisation we use client certificate authentication and would like to require x509 authentication for certain pages hosted by GitLab Pages. This MR adds support for client certificate authentication. It supports several different modes:

  1. For all domains set by CLI/env flags
  2. On a per-domain basis set by the GitLab API
  3. From a list of domains set by CLI/env flags

I've run into two issues during development that I would appreciate some feedback on:

  1. I couldn't quite crack how to properly test this feature. The test harness for TLS doesn't appear to ever be used so I wasn't sure how to actually use it. Following the doco to start Pages manually doesn't work and just throws an error: artifacts-server scheme must be either http:// or https://. Ideally I should be able to run and test Pages without an entire GitLab...
  2. It should support GitLab providing the certificate authority to verify client certificates against, however getting that added to GitLab is a much larger undertaking. Ideally it would be nice to get this into Pages without GitLab API support and then remove the additional CLI flags (no. 3 in the above list) once GitLab can dynamically provide the certificates.

Keen to hear what you guys think.

TODO

Edited by Jaime Martinez

Merge request reports