Gitlab certificate issues

Hi everyone,

I’ve just deployed Gitlab from the Univention App Center.
In general I’m using letsencrypt wildcard certificates for apache2, postfix and dovecot. Please see my guide here, if you are interested: Letsencrypt app - wildcards supported?
However, I could not figure out how to use these in Gitlab. :frowning:

I used docker inspect -f '{{ .Mounts }}' gitlab-containerid to check the volumes mounted to the gitlab container:

{bind  /var/lib/univention-appcenter/apps/gitlab/conf /var/lib/univention-appcenter/apps/gitlab/conf   true rprivate}
{bind  /var/lib/univention-appcenter/apps/gitlab/data /var/lib/univention-appcenter/apps/gitlab/data   true rprivate}
{bind  /var/lib/univention-appcenter/apps/gitlab/logs /var/log/gitlab   true rprivate}
{bind  /var/lib/univention-appcenter/apps/gitlab/data /var/opt/gitlab   true rprivate}
{bind  /etc/apt/apt.conf.d/80proxy /etc/apt/apt.conf.d/81proxy  ro false rprivate}
{bind  /var/lib/univention-appcenter/apps/gitlab/conf /etc/gitlab   true rprivate}
{bind  /sys/fs/cgroup /sys/fs/cgroup  ro false rprivate}

Checking /var/lib/univention-appcenter/apps/gitlab/conf, I can see there is a folder called trusted-certs, which is referenced here:

However, the private key does not seem to be used, which confuses me even more, so I did not follow this guide.

The gitconfig of my client is quite simple, basically I’m using the certificate store of Windows (not domain joined):

[diff "astextplain"]
	textconv = astextplain
[filter "lfs"]
	clean = git-lfs clean -- %f
	smudge = git-lfs smudge -- %f
	process = git-lfs filter-process
	required = true
	sslBackend = schannel
	autocrlf = true
	fscache = true
	symlinks = false
	editor = \"C:\\\\Program Files\\\\Notepad++\\\\notepad++.exe\" -multiInst -notabbar -nosession -noPlugin
	rebase = false
	helper = manager

When I try to clone a repo via HTTPS, I get the following error:

git clone
Cloning into 'backend'...
fatal: unable to access '': schannel: failed to receive handshake, SSL/TLS connection failed

I’d highly appreciate if there’s a gitlab-pro around able to help.

Best regards

The solution was quite easy:
external_url ''
in file

Next I instructed gitlab to re-parse the config:
docker exec -it **CONTAINER_NAME** /bin/bash

Here you run the following two commands to commit the config:

gitlab-ctl reconfigure
gitlab-ctl restart

Furthermore, Visual Studio 2019 did not use the windows certificate store, so it could not check the letsencryptcertificate.
So to change that, I just ran the following command in a git bash:

git config --global http.sslBackend schannel

That’s it! Don’t know, why you do not configure it like this by default… Maybe a bug?

Best regards