GitLab CE 17.8.1容器仓库自签证书验证失败求助

我搭建了本地GitLab CE 17.8.1版本，尝试配置Container Registry，使用自签名证书。在运行流水线中的build-image任务时，出现证书验证失败错误：

执行的命令：

$ echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u  $CI_REGISTRY_USER --password-stdin

报错信息：

Error response from daemon: Get "https://registry.xxx.com:5001/v2/": tls: failed to verify certificate: x509: certificate signed by unknown authority

gitlab.rb中Registry相关配置如下：

registry_external_url 'https://registry.xxx.com:5001'
gitlab_rails['registry_enabled'] = true
gitlab_rails['registry_host'] = "registry.xxx.com"
gitlab_rails['registry_port'] = "5001"
gitlab_rails['registry_api_url'] = "http://127.0.0.1:5000"
registry['enable'] = true
registry['ssl_certificate'] = "/etc/gitlab/ssl/registry.xxx.com.crt"
registry['ssl_certificate_key'] = "/etc/gitlab/ssl
registry.xxx.com.key"
registry_nginx['ssl_certificate'] = "/etc/gitlab/ssl
registry.xxx.com.crt"
registry_nginx['ssl_certificate_key'] = "/etc/gitlab/ssl
registry.xxx.com.key"
registry['env'] = {
   'SSL_CERT_DIR' => "/opt/gitlab/embedded/ssl/certs/"
}

已做操作：生成证书（crt-key-pem）并添加至/etc/gitlab/ssl和/etc/gitlab/trusted-certs目录，执行了sudo update-ca-certificates和c_rehash .，之后运行了gitlab-ctl reconfigure和gitlab-ctl restart，但问题仍未解决。

1. 修复gitlab.rb配置中的路径错误 #

从配置内容看，registry['ssl_certificate_key']、registry_nginx['ssl_certificate']、registry_nginx['ssl_certificate_key']的路径存在换行错误，正确的单行路径应该是：

registry['ssl_certificate_key'] = "/etc/gitlab/ssl/registry.xxx.com.key"
registry_nginx['ssl_certificate'] = "/etc/gitlab/ssl/registry.xxx.com.crt"
registry_nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/registry.xxx.com.key"

路径换行会导致GitLab无法正确读取证书文件，修改后执行：

gitlab-ctl reconfigure
gitlab-ctl restart registry registry-nginx

2. 确保自签名证书包含完整证书链 #

自签名证书需要将CA根证书与服务器证书合并成完整链文件，否则Docker客户端无法完成验证。执行以下命令合并：

cat /etc/gitlab/ssl/ca-root.pem >> /etc/gitlab/ssl/registry.xxx.com.crt

完成后重新配置并重启GitLab相关服务。

3. 在GitLab Runner节点信任自签名证书 #

流水线的Docker命令是在Runner节点执行的，需将CA根证书添加到Runner节点的信任体系：

• 系统信任库：将CA根证书复制到/usr/local/share/ca-certificates/，更新信任列表：

  cp /path/to/ca-root.pem /usr/local/share/ca-certificates/ca-root.crt
  update-ca-certificates
  

• Docker专属证书目录：创建Docker证书目录并放入CA根证书，重启Docker：

  mkdir -p /etc/docker/certs.d/registry.xxx.com:5001/
  cp /path/to/ca-root.pem /etc/docker/certs.d/registry.xxx.com:5001/ca.crt
  systemctl restart docker
  

4. 验证Registry的SSL配置有效性 #

在GitLab服务器上执行以下命令，检查证书是否能被正确识别：

openssl s_client -connect registry.xxx.com:5001 -showcerts

查看输出中Verify return code是否为0 (ok)，若不为0则说明证书本身或配置仍存在问题。

5. 更新GitLab嵌入式证书存储 #

将CA根证书复制到GitLab嵌入式证书目录并更新哈希：

cp /path/to/ca-root.pem /opt/gitlab/embedded/ssl/certs/
cd /opt/gitlab/embedded/ssl/certs/
c_rehash .
gitlab-ctl restart

内容的提问来源于stack exchange，提问作者Moutaz1983