gitlab-runner 14.8.2 does not accept selfsigned certificate

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Close this issue

Summary

Installing a new CI runner with version 14.8.2 fails to register on self hosted gitlab server with self signed certificate.

I suspect that gitlab-runner since version 14.0.1 has been more intolerant towards certificates.

Steps to reproduce

A gitlab server with a self signed certitifate is needed. The certificate on the gitlab server was created in this way.

sudo openssl genrsa -out gitlab.practek.cn.key 2048
sudo openssl req -new -addext "subjectAltName = DNS:gitlab.practek.cn" -key gitlab.practek.cn.key -out gitlab.practek.cn.csr
sudo openssl x509 -req -days 36500 -in gitlab.practek.cn.csr -signkey gitlab.practek.cn.key -out gitlab.practek.cn.crt

To be able to use the server a CA file is generated (https://stackoverflow.com/a/47206625/1809810)

SERVER=gitlab.example.com
PORT=443
CERTIFICATE=/srv/runner/${SERVER}.crt
# Get the certificate in PEM format and store it
openssl s_client -connect ${SERVER}:${PORT} -showcerts </dev/null 2>/dev/null | sed -e '/-----BEGIN/,/-----END/!d' | sudo tee "$CERTIFICATE" >/dev/null

And then passed to the gitlab runner command:

gitlab-runner register --tls-ca-file="$CERTIFICATE" [your other options]

The runner is started via docker-compose

version: '2' 
services:
  runner:
    container_name: gitlab-runner
    #image: gitlab/gitlab-runner:latest
    restart: always
    ports:
      - '0.0.0.0:8093:8093'
    volumes:
      - /tmp/srv/runner/config:/etc/gitlab-runner
      - /tmp/srv/runner:/srv/runner
      - /var/run/docker.sock:/var/run/docker.sock
      - /data:/data
      - /etc/docker/certs.d:/etc/docker/certs.d

What is the current bug behavior?

# gitlab-runner -v
Version:      14.8.2
Git revision: c6e7e194
Git branch:   14-8-stable
GO version:   go1.17.7
Built:        2022-03-01T17:18:25+0000
OS/Arch:      linux/amd64

$ docker-compose exec runner gitlab-runner register --tls-ca-file=/srv/runner/gitlab.practek.pem --url https://gitlab.practek.cn/ --registration-token VFzKhnHYggDrXeQR3mtG --executor docker --docker-image ubuntu:20.04
Runtime platform                                    arch=amd64 os=linux pid=40 revision=c6e7e194 version=14.8.2
Running in system-mode.                            
                                                   
Enter the GitLab instance URL (for example, https://gitlab.com/):
[https://gitlab.practek.cn/]: 
Enter the registration token:
[VFzKhnHYggDrXeQR3mtG]: 
Enter a description for the runner:
[kfa-Latitude-5580]: kfa
Enter tags for the runner (comma-separated):
kfa
Enter optional maintenance note for the runner:
kfa
ERROR: Registering runner... failed                 runner=VFzKhnHY status=couldn't execute POST against https://gitlab.practek.cn/api/v4/runners: Post "https://gitlab.practek.cn/api/v4/runners": x509: certificate relies on legacy Common Name field, use SANs instead
PANIC: Failed to register the runner. You may be having network problems.

What is the expected correct behavior?

Changing the docker image to the same as another gitlab-runner makes the register work. gitlab/gitlab-runner@sha256:bb6d24855ff82514e3f3e59b142051e80b8ae5d06fa6bc935487972986be20a7

# gitlab-runner -v
Version:      14.0.1
Git revision: c1edb478
Git branch:   refs/pipelines/326100216
GO version:   go1.13.8
Built:        2021-06-23T16:35:23+0000
OS/Arch:      linux/amd64

$ docker-compose exec runner gitlab-runner register --tls-ca-file=/srv/runner/gitlab.practek.pem --url https://gitlab.practek.cn/ --registration-token VFzKhnHYggDrXeQR3mtG --executor docker --docker-image ubuntu:20.04
Runtime platform                                    arch=amd64 os=linux pid=26 revision=c1edb478 version=14.0.1
Running in system-mode.                            
                                                   
Enter the GitLab instance URL (for example, https://gitlab.com/):
[https://gitlab.practek.cn/]: 
Enter the registration token:
[VFzKhnHYggDrXeQR3mtG]: 
Enter a description for the runner:
[kfa-Latitude-5580]: kfc
Enter tags for the runner (comma-separated):
kfa
Registering runner... succeeded                     runner=VFzKhnHY
Enter an executor: shell, ssh, virtualbox, docker-ssh+machine, kubernetes, custom, docker, docker+machine, docker-ssh, parallels:
[docker]: docker
Enter the default Docker image (for example, ruby:2.6):
[ubuntu:20.04]: 
Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded!

Results of GitLab environment info

Expand for output related to GitLab environment info

This is from the gitlab server

# gitlab-rake gitlab:env:info

System information
System:		
Current User:	git
Using RVM:	no
Ruby Version:	2.7.2p137
Gem Version:	3.1.4
Bundler Version:2.1.4
Rake Version:	13.0.3
Redis Version:	6.0.12
Git Version:	2.31.1
Sidekiq Version:5.2.9
Go Version:	unknown

GitLab information
Version:	13.12.4
Revision:	02b97bd2a77
Directory:	/opt/gitlab/embedded/service/gitlab-rails
DB Adapter:	PostgreSQL
DB Version:	12.6
URL:		https://gitlab.practek.cn
HTTP Clone URL:	https://gitlab.practek.cn/some-group/some-project.git
SSH Clone URL:	git@gitlab.practek.cn:some-group/some-project.git
Using LDAP:	no
Using Omniauth:	yes
Omniauth Providers: 

GitLab Shell
Version:	13.18.0
Repository storage paths:
- default: 	/var/opt/gitlab/git-data/repositories
GitLab Shell path:		/opt/gitlab/embedded/service/gitlab-shell
Git:		/opt/gitlab/embedded/bin/git


(For installations from source run and paste the output of:
`sudo -u git -H bundle exec rake gitlab:env:info RAILS_ENV=production`)

Results of GitLab application Check

Expand for output related to the GitLab application check

# gitlab-rake gitlab:env:info

System information System: Current User: git Using RVM: no Ruby Version: 2.7.2p137 Gem Version: 3.1.4 Bundler Version:2.1.4 Rake Version: 13.0.3 Redis Version: 6.0.12 Git Version: 2.31.1 Sidekiq Version:5.2.9 Go Version: unknown

GitLab information Version: 13.12.4 Revision: 02b97bd2a77 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 12.6 URL: https://gitlab.practek.cn HTTP Clone URL: https://gitlab.practek.cn/some-group/some-project.git SSH Clone URL: git@gitlab.practek.cn:some-group/some-project.git Using LDAP: no Using Omniauth: yes Omniauth Providers:

GitLab Shell Version: 13.18.0 Repository storage paths:

default: /var/opt/gitlab/git-data/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git root@gitlab:/# root@gitlab:/# gitlab-rake gitlab:check SANITIZE=true Checking GitLab subtasks ...

Checking GitLab Shell ...

GitLab Shell: ... GitLab Shell version >= 13.18.0 ? ... OK (13.18.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Internal API available: OK Redis available via internal API: OK gitlab-shell self-check successful

Checking GitLab Shell ... Finished

Checking Gitaly ...

Gitaly: ... default ... OK

Checking Gitaly ... Finished

Checking Sidekiq ...

Sidekiq: ... Running? ... yes Number of Sidekiq processes (cluster/worker) ... 1/1

Checking Sidekiq ... Finished

Checking Incoming Email ...

Incoming Email: ... Reply by email is disabled in config/gitlab.yml

Checking Incoming Email ... Finished

Checking LDAP ...

LDAP: ... LDAP is disabled in config/gitlab.yml

Checking LDAP ... Finished

Checking GitLab App ...

Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 4/4 ... yes 5/5 ... yes 5/6 ... yes 10/7 ... yes 12/8 ... yes 5/9 ... yes 5/10 ... yes 5/11 ... yes 5/12 ... yes 5/13 ... yes 5/14 ... yes 5/15 ... yes 5/16 ... yes 5/17 ... yes 5/18 ... yes 5/19 ... yes 5/20 ... yes 5/21 ... yes 5/22 ... yes 5/23 ... yes 5/24 ... yes 5/25 ... yes 5/26 ... yes 5/27 ... yes 26/28 ... yes 26/29 ... yes 26/30 ... yes 4/31 ... yes 28/33 ... yes 29/34 ... yes 5/35 ... yes 4/36 ... yes 30/37 ... yes 31/39 ... yes 4/41 ... yes 4/42 ... yes 4/43 ... yes 4/44 ... yes 4/45 ... yes 4/46 ... yes 4/47 ... yes 5/50 ... yes 32/51 ... yes 28/52 ... yes 30/53 ... yes 34/54 ... yes 34/55 ... yes 34/56 ... yes 26/57 ... yes 40/58 ... yes 41/59 ... yes 4/60 ... yes 4/62 ... yes 4/65 ... yes 4/66 ... yes 27/67 ... yes 5/68 ... yes 5/69 ... yes 5/71 ... yes 5/72 ... yes 34/73 ... yes 34/74 ... yes 34/75 ... yes 34/76 ... yes 34/77 ... yes 34/78 ... yes 5/79 ... yes 5/80 ... yes 4/81 ... yes 31/82 ... yes 31/83 ... yes 31/84 ... yes 43/85 ... yes 34/86 ... yes 44/87 ... yes 46/88 ... yes 46/89 ... yes 46/90 ... yes 46/91 ... yes 5/92 ... yes 5/93 ... yes 5/94 ... yes 5/95 ... yes 5/96 ... yes 5/97 ... yes 5/98 ... yes 5/99 ... yes 5/100 ... yes 5/101 ... yes 34/102 ... yes 2/104 ... yes 15/105 ... yes 22/106 ... yes Redis version >= 5.0.0? ... yes Ruby version >= 2.7.2 ? ... yes (2.7.2) Git version >= 2.31.0 ? ... yes (2.31.1) Git user has default SSH configuration? ... yes Active users: ... 21 Is authorized keys file accessible? ... yes GitLab configured to store new projects in hashed storage? ... yes All projects are in hashed storage? ... yes

Checking GitLab App ... Finished

Checking GitLab subtasks ... Finished

Possible fixes

Use an older runner version

Edited Oct 14, 2025 by 🤖 GitLab Bot 🤖