fatal: unable to access 'https://gitlab-ci-token:[MASKED]@gitlab.mydomain.com/xxx.git/': SSL certificate problem: unable to get issuer certificate

Question

I am not able to have a successful run of the autodevops pipeline. I have gone through multiple tutorials, guides, issues, fixes, workarounds but I now reached a point where I need your support.

I have a home kubernetes cluster (two VMs) and a GitLab server using HTTPS. I have set up the cluster and defined it in a GitLab group level (helm, ingress, runner installed). I have to do few tunings to be able to make the runner register in gitlab (it was not accepting the certificate initially).

Now when I run the autodevops pipeline, I get an error in the logs as below:

Running with gitlab-runner 11.9.0 (692ae235)
  on runner-gitlab-runner-5976795575-8495m cwr6YWh8
Using Kubernetes namespace: gitlab-managed-apps
Using Kubernetes executor with image registry.gitlab.com/gitlab-org/cluster-integration/auto-build-image/master:stable ...
Waiting for pod gitlab-managed-apps/runner-cwr6ywh8-project-33-concurrent-0q7bdk to be running, status is Pending
Running on runner-cwr6ywh8-project-33-concurrent-0q7bdk via runner-gitlab-runner-5976795575-8495m...
Initialized empty Git repository in /testing/helloworld/.git/
Fetching changes...
Created fresh repository.
fatal: unable to access 'https://gitlab-ci-token:[MASKED]@gitlab.mydomain.com/testing/helloworld.git/': SSL certificate problem: unable to get issuer certificate

I have tried many workarounds like adding the CA certificate of my domain under /home/gitlab-runner/.gitlab-runner/certs/gitlab.mydomain.com.crt but still no results.

Answer 1

Your error occurs when a self-signed certificate can't be verified.

Another workaround than adding CA certificate is forcing git to not perform the validation of the certificate using the global option:

$ git config --global http.sslVerify false

Answer 2

There is a list of solutions for this problem presented here: https://gitlab.com/gitlab-org/gitlab-runner/issues/2659

The most likely but crude solution is: open /etc/gitlab-runner/config.toml and modify as follows:

[[runners]]

environment = ["GIT_SSL_NO_VERIFY=true"]

Then restart the gitlab runner.