Gitlab 代理 SSL (Docker) 证书验证失败

Question

我在 Nginx 反向代理(两个 docker 容器)后面有一个自托管的 Gitlab omnibus 安装。在浏览器中一切正常，但是当我尝试克隆存储库时出现以下错误:

server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none

Nginx 配置

upstream gitlab{
  server gitlab:80;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# HTTP server to redirect all 80 traffic to SSL/HTTPS
server {
    listen 80;
    server_name ${DOMAIN_NAME};

    # Tell all requests to port 80 to be 302 redirected to HTTPS
    return 302 https://$host$request_uri;
}

server {
    listen 443;
    ssl on;

    server_name ${DOMAIN_NAME};

    ssl_certificate /etc/ssl/certs/${SSL_CERT};
    ssl_certificate_key /etc/ssl/certs/${SSL_CERT_KEY};

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_ciphers 'ECDHE-RSA-AES128...';
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_stapling on;
    ssl_stapling_verify on;
    add_header Strict-Transport-Security max-age=15768000;

    location /gitlab {
        proxy_pass http://gitlab;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_hide_header 'X-Frame-Options';
    }
}

Gitlab 配置

external_url 'https://${DOMAIN_NAME}/gitlab/'
[...]
nginx['listen_port'] = 80
nginx['listen_https'] = false
nginx['ssl_ciphers'] = 'ECDHE-RSA-AES128...'
nginx['proxy_set_headers'] = {
"X-Forwarded-Proto" => "https",
"X-Forwarded-Ssl" => "on"

Answer 1

问题出在证书上，您需要提供 CA 全链(您的浏览器不一定需要它，但 curl/git/etc 需要)