{"id":2173,"date":"2017-10-06T21:20:23","date_gmt":"2017-10-06T15:50:23","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=2173"},"modified":"2026-09-17T16:43:24","modified_gmt":"2026-09-17T11:13:24","slug":"install-ssl-certificate-gitlab","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/install-ssl-certificate-gitlab\/","title":{"rendered":"How to install SSL certificate on gitlab"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Securing your GitLab instance with an SSL certificate is an essential step in protecting source code, user credentials, and all communication between users and the server. Enabling HTTPS encrypts data in transit, improves security, and helps organizations comply with security best practices.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide explains how to install and configure an SSL certificate on a self-managed GitLab server. The procedure assumes that you already have a valid SSL certificate and its corresponding private key.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before proceeding, ensure you have the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A working GitLab installation<\/li>\n\n\n\n<li>Access to the GitLab configuration directory (<code>\/etc\/gitlab<\/code>)<\/li>\n\n\n\n<li>A valid SSL certificate<\/li>\n\n\n\n<li>The corresponding private key<\/li>\n\n\n\n<li>A configured domain name (for example, <code>git.domain.tld<\/code>)<\/li>\n\n\n\n<li>Root or sudo access to the server<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Implementation<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">Step 1: Create the SSL Directory<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Create a dedicated directory to store the SSL certificate and private key.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">mkdir -p \/etc\/gitlab\/ssl<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Step 2: Secure the SSL Directory<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Set appropriate permissions to restrict access.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">chmod 700 \/etc\/gitlab\/ssl<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Step 3: Add the SSL Certificate<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Create the certificate file and paste the SSL certificate content into it.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">vi \/etc\/gitlab\/ssl\/domaintld.pem<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Step 4: Add the Private Key<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Create the private key file and paste the private key content into it.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">vi \/etc\/gitlab\/ssl\/domaintld.key<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Step 5: Configure GitLab to Use SSL<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Edit the GitLab configuration file:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">vi \/etc\/gitlab\/gitlab.rb<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add or update the following configuration:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">external_url 'https:\/\/git.domain.tld'\n\nnginx['redirect_http_to_https'] = true\nnginx['ssl_certificate'] = \"\/etc\/gitlab\/ssl\/domaintld.pem\"\nnginx['ssl_certificate_key'] = \"\/etc\/gitlab\/ssl\/domaintld.key\"<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Configuration Overview<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>external_url<\/code> \u2013 Defines the GitLab URL that users will access.<\/li>\n\n\n\n<li><code>redirect_http_to_https<\/code> \u2013 Automatically redirects HTTP requests to HTTPS.<\/li>\n\n\n\n<li><code>ssl_certificate<\/code> \u2013 Specifies the SSL certificate file path.<\/li>\n\n\n\n<li><code>ssl_certificate_key<\/code> \u2013 Specifies the private key file path.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Step 6: Apply the Configuration<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Reconfigure GitLab to apply the new SSL settings.<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">gitlab-ctl reconfigure<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Step 7: Verify HTTPS Access<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Open your GitLab URL in a web browser:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">https:\/\/git.domain.tld<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm that:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The site loads successfully over HTTPS.<\/li>\n\n\n\n<li>The browser displays a secure padlock icon.<\/li>\n\n\n\n<li>The SSL certificate information is valid and trusted.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Verify GitLab Services<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Check the status of GitLab services:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">gitlab-ctl status<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Review GitLab Logs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If GitLab does not start correctly after enabling SSL, review the logs:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">gitlab-ctl tail<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Check Certificate and Key Files<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ensure:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The certificate file path is correct.<\/li>\n\n\n\n<li>The private key file path is correct.<\/li>\n\n\n\n<li>The certificate and private key match.<\/li>\n\n\n\n<li>File permissions allow GitLab to read the files.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Installing an SSL certificate on GitLab helps secure user authentication, repository access, and all communication between clients and the server. By configuring HTTPS and redirecting HTTP traffic automatically, you improve both security and user confidence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After completing the setup, regularly monitor certificate expiration dates and renew certificates before they expire to ensure uninterrupted secure access to your GitLab environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions (FAQ)<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">1. How do I verify that the SSL certificate is working correctly?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Access your GitLab URL using HTTPS and check for a secure padlock icon in the browser. You can also inspect the certificate details to confirm that the correct certificate is being served.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2. What happens if the SSL certificate expires?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Users may receive browser security warnings, and secure access to GitLab can be disrupted. It is recommended to renew certificates before their expiration date.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">3. Can I use a Let&#8217;s Encrypt certificate with GitLab?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. GitLab supports Let&#8217;s Encrypt certificates and can automatically obtain and renew them. Alternatively, you can manually install a Let&#8217;s Encrypt certificate using the same SSL configuration process described in this guide.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">4. How do I force all users to access GitLab through HTTPS?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Enable the following setting in <code>gitlab.rb<\/code>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">nginx['redirect_http_to_https'] = true<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This automatically redirects all HTTP requests to HTTPS.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">5. Where are SSL certificates typically stored in GitLab?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">A common practice is to store SSL certificates and private keys under:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/gitlab\/ssl\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">with restricted permissions to protect sensitive key files.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Related Articles<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/nagios-with-gitlab-in-independent-vps\/\"><strong>Nagios with GitLab in Independent VPS<\/strong><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-to-set-up-gitlab-backups-within-amazon-s3-bucket\/\"><strong>How to Set Up GitLab Backups Within Amazon S3 Bucket<\/strong><\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-to-upgrade-gitlab-to-the-latest-version\/\"><strong>How to Upgrade GitLab to the Latest Version<\/strong><br><\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Talk to our experts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team&nbsp;<a href=\"https:\/\/pheonixsolutions.com\/contact\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Securing your GitLab instance with an SSL certificate is an essential step in protecting source code, user credentials, and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1024],"tags":[283,397,277],"class_list":["post-2173","post","type-post","status-publish","format-standard","hentry","category-security","tag-git","tag-gitlab","tag-ssl","psol-cat-security"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-z3","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=2173"}],"version-history":[{"count":1,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2173\/revisions"}],"predecessor-version":[{"id":11831,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2173\/revisions\/11831"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=2173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=2173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=2173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}