GitLab Runner注册报错：证书依赖旧CN字段，需使用SAN

问题概况 #

通过Docker搭建GitLab服务器并配置Runner时，注册阶段持续报错：

tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead

证书生成步骤 #

openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=DE/ST=BW/O=Example Company/CN=GitLab CA"
openssl genrsa -out server.key 4096
openssl req -new -key server.key -out server.csr -subj "/C=DE/ST=Baden-Wüttemberg/L=Mannheim/O=Example/OU=IT Dept/CN=gitlab.local" -addext "subjectAltName = DNS:localhost,DNS:gitlab.local"
openssl x509 -req -in server.csr -out server.crt -days 3650 -CA ca.crt -CAkey ca.key -CAcreateserial

Runner注册命令 #

docker exec -it gitlab-runner-1 gitlab-runner register --url https://gitlab.local --token glrt-v8Cjr4ZaVQGKnnws7tAx --tls-ca-file /etc/gitlab-runner/ssl/ca.crt

已完成配置 #

• 将server.crt和server.key配置到GitLab服务器
• 为GitLab Runner指定了ca.crt文件路径
• Docker Compose配置如下：

version: '3.8'
services:
  gitlab:
    image: gitlab/gitlab-ee:latest
    container_name: gitlab
    restart: always
    hostname: 'gitlab.local'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://gitlab.example.de'
        gitlab_rails['gitlab_shell_ssh_port'] = 2222
    networks:
      - internal-services
      - gitlab-runner-network
    volumes:
      - '/docker-volumes/gitlab/config:/etc/gitlab'
      - '/docker-volumes/gitlab/logs:/var/log/gitlab'
      - '/docker-volumes/gitlab/data:/var/opt/gitlab'
    shm_size: '256m'
  gitlab-runner-1:
    image: gitlab/gitlab-runner:latest
    container_name: gitlab-runner-1
    hostname: gitlab-runner-1.local
    restart: always
    networks:
      - gitlab-runner-network
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /docker-volumes/gitlab-runner/config-1:/etc/gitlab-runner

networks:
  internal-services:
    external: true
  gitlab-runner-network:
    external: true

已尝试方案 #

参考Stack Overflow相关问题，但未解决问题。

解决思路 #

1. 修正GitLab域名与证书SAN的不匹配问题 #

Docker Compose中GitLab的external_url设置为https://gitlab.example.de，但证书SAN仅包含localhost和gitlab.local，Runner连接的是gitlab.local，三者域名不一致导致验证失败。

• 重新生成CSR，添加gitlab.example.de到SAN字段：

openssl req -new -key server.key -out server.csr -subj "/C=DE/ST=Baden-Wüttemberg/L=Mannheim/O=Example/OU=IT Dept/CN=gitlab.local" -addext "subjectAltName = DNS:localhost,DNS:gitlab.local,DNS:gitlab.example.de"

• 重新签发证书，替换GitLab的server.crt和server.key，重启GitLab容器。

2. 确保证书签发时正确携带SAN扩展 #

使用openssl x509 -in server.crt -text -noout检查证书内容，确认X509v3 Subject Alternative Name字段存在且包含所有目标域名。如果该字段缺失，需修改签发命令：

# 创建扩展配置文件
echo "subjectAltName = DNS:localhost,DNS:gitlab.local,DNS:gitlab.example.de" > extfile.cnf
# 重新签发证书
openssl x509 -req -in server.csr -out server.crt -days 3650 -CA ca.crt -CAkey ca.key -CAcreateserial -extfile extfile.cnf

3. 验证Runner容器内的CA证书配置 #

• 确认ca.crt已放置到/etc/gitlab-runner/ssl/ca.crt路径
• 检查文件权限为可读（如chmod 644），可进入容器验证：

docker exec -it gitlab-runner-1 cat /etc/gitlab-runner/ssl/ca.crt

4. 排查网络与DNS解析 #

在Runner容器内执行ping gitlab.local和ping gitlab.example.de，确认域名能正确解析到GitLab容器IP。若解析失败，需在容器hosts或网络配置中添加正确的域名映射。

内容的提问来源于stack exchange，提问作者Maximilian Schüller