Introduction
Securing your GitLab instance with an SSL certificate is an essential step in protecting source code, user credentials, and all communication between users and the server. Enabling HTTPS encrypts data in transit, improves security, and helps organizations comply with security best practices.
This guide explains how to install and configure an SSL certificate on a self-managed GitLab server. The procedure assumes that you already have a valid SSL certificate and its corresponding private key.
Prerequisites
Before proceeding, ensure you have the following:
- A working GitLab installation
- Access to the GitLab configuration directory (
/etc/gitlab) - A valid SSL certificate
- The corresponding private key
- A configured domain name (for example,
git.domain.tld) - Root or sudo access to the server
Implementation
Step 1: Create the SSL Directory
Create a dedicated directory to store the SSL certificate and private key.
mkdir -p /etc/gitlab/ssl
Step 2: Secure the SSL Directory
Set appropriate permissions to restrict access.
chmod 700 /etc/gitlab/ssl
Step 3: Add the SSL Certificate
Create the certificate file and paste the SSL certificate content into it.
vi /etc/gitlab/ssl/domaintld.pem
Step 4: Add the Private Key
Create the private key file and paste the private key content into it.
vi /etc/gitlab/ssl/domaintld.key
Step 5: Configure GitLab to Use SSL
Edit the GitLab configuration file:
vi /etc/gitlab/gitlab.rb
Add or update the following configuration:
external_url 'https://git.domain.tld' nginx['redirect_http_to_https'] = true nginx['ssl_certificate'] = "/etc/gitlab/ssl/domaintld.pem" nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/domaintld.key"
Configuration Overview
external_url– Defines the GitLab URL that users will access.redirect_http_to_https– Automatically redirects HTTP requests to HTTPS.ssl_certificate– Specifies the SSL certificate file path.ssl_certificate_key– Specifies the private key file path.
Step 6: Apply the Configuration
Reconfigure GitLab to apply the new SSL settings.
gitlab-ctl reconfigure
Step 7: Verify HTTPS Access
Open your GitLab URL in a web browser:
https://git.domain.tld
Confirm that:
- The site loads successfully over HTTPS.
- The browser displays a secure padlock icon.
- The SSL certificate information is valid and trusted.
Troubleshooting
Verify GitLab Services
Check the status of GitLab services:
gitlab-ctl status
Review GitLab Logs
If GitLab does not start correctly after enabling SSL, review the logs:
gitlab-ctl tail
Check Certificate and Key Files
Ensure:
- The certificate file path is correct.
- The private key file path is correct.
- The certificate and private key match.
- File permissions allow GitLab to read the files.
Conclusion
Installing an SSL certificate on GitLab helps secure user authentication, repository access, and all communication between clients and the server. By configuring HTTPS and redirecting HTTP traffic automatically, you improve both security and user confidence.
After completing the setup, regularly monitor certificate expiration dates and renew certificates before they expire to ensure uninterrupted secure access to your GitLab environment.
Frequently Asked Questions (FAQ)
1. How do I verify that the SSL certificate is working correctly?
Access your GitLab URL using HTTPS and check for a secure padlock icon in the browser. You can also inspect the certificate details to confirm that the correct certificate is being served.
2. What happens if the SSL certificate expires?
Users may receive browser security warnings, and secure access to GitLab can be disrupted. It is recommended to renew certificates before their expiration date.
3. Can I use a Let’s Encrypt certificate with GitLab?
Yes. GitLab supports Let’s Encrypt certificates and can automatically obtain and renew them. Alternatively, you can manually install a Let’s Encrypt certificate using the same SSL configuration process described in this guide.
4. How do I force all users to access GitLab through HTTPS?
Enable the following setting in gitlab.rb:
nginx['redirect_http_to_https'] = true
This automatically redirects all HTTP requests to HTTPS.
5. Where are SSL certificates typically stored in GitLab?
A common practice is to store SSL certificates and private keys under:
/etc/gitlab/ssl/
with restricted permissions to protect sensitive key files.
Related Articles
- Nagios with GitLab in Independent VPS
- How to Set Up GitLab Backups Within Amazon S3 Bucket
- How to Upgrade GitLab to the Latest Version
Talk to our experts
Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team here.