AWS EC2上GitLab Runner启动时出现tls: bad certificate错误求助

安全阿岳

2026-7-6

解决GitLab Runner在AWS EC2上的TLS证书错误

问题根源

你配置了amazonec2-use-private-address=true，但Docker Machine默认会用实例的公网IP生成TLS证书，当runner管理器通过私有IP访问新创建的runner实例时，证书内置的IP和实际访问的IP不匹配，就会触发tls: bad certificate错误。

修复步骤

清理现有故障实例
先停掉GitLab Runner服务，删除所有存在证书错误的Docker Machine实例：
```
sudo systemctl stop gitlab-runner
sudo docker-machine rm $(sudo docker-machine ls -q --filter state=Running)
```

修改config.toml配置
在[runners.machine]的MachineOptions里添加两个关键参数，强制Docker Machine用私有IP生成证书并适配你的TLS验证设置：

"amazonec2-private-address-only=true",
"engine-tls-verify=false"

修改后的MachineOptions示例：

MachineOptions = [
  "amazonec2-access-key=XXXXXXXX",
  "amazonec2-secret-key=XXXXXX",
  "amazonec2-region=eu-central-1",
  "amazonec2-vpc-id=vpc-XXXXXXX",
  "amazonec2-subnet-id=subnet-XXXXX",
  "amazonec2-use-private-address=true",
  "amazonec2-private-address-only=true",
  "engine-tls-verify=false",
  "amazonec2-tags=runner-manager-name,gitlab-aws-autoscaler,gitlab,true,gitlab-runner-autoscale,true",
  "amazonec2-security-group=gitlab-runner-sec-group",
  "amazonec2-instance-type=t2.small",
  "amazonec2-request-spot-instance=true",
  "amazonec2-spot-price=0.05",
  "amazonec2-zone=a"
]

重启服务并验证
重新启动GitLab Runner，实时查看日志确认运行状态：
```
sudo systemctl start gitlab-runner
sudo journalctl -u gitlab-runner -f
```
等待几分钟后，检查Docker Machine实例状态：
```
sudo docker-machine ls
```