Notes gitlab - certificats CA

cp -p *.crt /usr/local/share/ca-certificates/ update-ca-certificates

# curl -I https://arty.acme.local
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

# curl --cacert /usr/local/share/ca-certificates/acme-subca1.crt -I https://arty.acme.local
HTTP/1.1 200 OK
...

# wget https://arty.acme.local
--2026-06-11 11:41:00-- https://arty.acme.local/
Resolving arty.acme.local (arty.acme.local)... 10.245.208.69, 10.245.208.36
Connecting to arty.acme.local (arty.acme.local)|10.245.208.69|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 23381 (23K) [text/html]
Saving to: ‘index.html’
index.html 100%[====================================================================================================================>] 22.83K --.-KB/s in 0.02s
2026-06-11 11:41:00 (1.00 MB/s) - ‘index.html’ saved [23381/23381]

# which curl
/opt/gitlab/embedded/bin/curl

# cat /opt/gitlab/etc/gitaly/env/SSL_CERT_DIR ; echo
/opt/gitlab/embedded/ssl/certs/
# cat /opt/gitlab/embedded/ssl/certs/README
This directory is managed by omnibus-gitlab.
Any file placed in this directory will be ignored
. Place certificates in /etc/gitlab/trusted-certs.
# ls -l /etc/gitlab/trusted-certs
total 0

Solution

cp -p /usr/local/share/ca-certificates/* /etc/gitlab/trusted-certs/

Redémarrer Gitlab