To enable HTTPS on a Linux-package (Omnibus) GitLab server, give GitLab a DNS name, set external_url to an HTTPS URL in /etc/gitlab/gitlab.rb, choose either GitLab’s ACME/Let’s Encrypt automation or a manually installed certificate, and run sudo gitlab-ctl reconfigure. The exact certificate steps change if TLS ends at a reverse proxy, or if your installation uses Helm or a self-compiled build.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What SSL setup changes in GitLab
SSL is commonly called TLS in current documentation. It encrypts browser sessions, Git over HTTPS, API requests, container-registry traffic and other connections to the GitLab hostname. A certificate also proves that the hostname belongs to the server or proxy presenting it.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →GitLab’s Linux package does not turn on HTTPS automatically. GitLab’s documentation states, “By default, HTTPS is not enabled.” The normal Omnibus configuration is driven from /etc/gitlab/gitlab.rb; after changing that file, gitlab-ctl reconfigure renders the NGINX and service configuration.
This guide assumes a self-hosted Linux-package installation unless a section explicitly says otherwise. The hostname in the examples is gitlab.example.com. Replace it with the fully qualified domain name (FQDN) users actually enter.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Choose the TLS architecture before changing files
| Architecture | Where TLS terminates | Certificate management | Best fit |
|---|---|---|---|
| Bundled NGINX with Let’s Encrypt | GitLab’s packaged NGINX | Automated ACME issuance and renewal | Public GitLab hostname with reachable ports 80 and 443 |
| Bundled NGINX with a manual certificate | GitLab’s packaged NGINX | You obtain, install and renew the key and chain | Private PKI, commercial certificate, air-gapped network or another ACME client |
| External reverse proxy or load balancer | Proxy or load balancer | Managed on that external device | Centralized ingress, multiple backends or an existing edge gateway |
| Helm deployment | Kubernetes Ingress or Gateway | Kubernetes Secret and optionally cert-manager | GitLab deployed in Kubernetes |
| Self-compiled GitLab | Your NGINX or web-server configuration | Configured outside the Omnibus file layout | Source-built installations |
Do not combine models casually. For example, paths under /etc/gitlab/ssl apply to the Linux package; they are not the certificate mechanism for a Helm release.
Prerequisites for an Omnibus HTTPS installation
- A stable FQDN, such as
gitlab.example.com, that matches the certificate’s subject or subject-alternative name. - A DNS record pointing that name to the public address that accepts GitLab traffic. GitLab says a domain name is required for HTTPS, and its DNS guidance says the name must be resolvable over the public internet when using the public ACME validation path.
- Administrative shell access with permission to edit
/etc/gitlab/gitlab.rband runsudo gitlab-ctl. - A decision about whether the packaged NGINX, an external proxy, or a Kubernetes ingress will terminate TLS.
- A backup of the current GitLab configuration and a maintenance window if this server is already serving users.
For an Internet-validated Let’s Encrypt certificate, inbound TCP ports 80 and 443 must reach the validation endpoint and GitLab. Firewalls, NAT rules, security groups and an upstream proxy all need to permit the challenge and normal HTTPS traffic. A private hostname, split-horizon DNS name or air-gapped server cannot complete the ordinary public validation flow.
Fast path: enable HTTPS with Let’s Encrypt
GitLab’s Omnibus integration uses ACME and can request and renew certificates automatically. GitLab documents a 90-day certificate lifetime, so automation is important rather than optional for a busy production server.
1. Create and verify the public DNS name
- Create an A or AAAA record for
gitlab.example.compointing to the address that will answer on ports 80 and 443. - From a network outside your internal DNS, confirm that the name resolves to the intended public address.
- Confirm that no other service is consuming port 80 or 443 on the GitLab host unless that service is deliberately acting as the TLS edge.
If DNS resolves only inside your organization, use a certificate from an internal CA or another private ACME service instead of public Let’s Encrypt validation.
2. Set the HTTPS external URL
Edit the Omnibus configuration:
sudo editor /etc/gitlab/gitlab.rbSet the URL to the exact hostname users will use:
external_url "https://gitlab.example.com"Do not use an IP address when the certificate is issued for a DNS name. The URL controls GitLab’s canonical links as well as the packaged web-server configuration.
3. Leave certificate paths unset and optionally add contact email
For the integrated Let’s Encrypt flow, do not point NGINX at a manually copied key or certificate. You may set a contact address for ACME notices:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
letsencrypt['contact_emails'] = ['[email protected]']Use an address that is monitored. The 90-day lifetime means a missed renewal can become an outage.
4. Reconfigure GitLab
sudo gitlab-ctl reconfigureDuring reconfiguration GitLab requests the certificate, configures its bundled NGINX and applies the HTTPS URL. Read the command output for DNS, port, or ACME challenge errors rather than assuming a successful shell return means the certificate was issued.
5. Decide whether to redirect HTTP
If users who type an HTTP URL should be sent to HTTPS, add:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
gitlab_rails['nginx']['redirect_http_to_https'] = trueRun reconfigure again:
sudo gitlab-ctl reconfigureKeep port 80 reachable when the ACME HTTP-01 challenge and HTTP-to-HTTPS redirects both depend on it. Test the redirect from a client after reconfiguration.
6. Understand renewal behavior
GitLab schedules ACME renewal automatically. The documented default runs after midnight on every fourth day of the month, with the minute distributed using the external_url value; administrators can set an explicit hour and minute. This scheduling behavior is version-sensitive, so check the SSL configuration for the GitLab version you operate before relying on an exact execution time. Monitor renewal logs and alert before expiry instead of treating the scheduler as a substitute for monitoring.
GitLab’s ACME integration is not limited to Let’s Encrypt endpoints. It can use other ACME services, including ZeroSSL, Buypass, SSL.com and step-ca. GitLab recommends testing a staging endpoint before production issuance so that configuration mistakes do not consume production ACME rate limits.
Install a certificate manually in Omnibus
Manual installation is appropriate for an internal CA, a certificate obtained from an organization’s approved authority, an air-gapped environment, or an ACME client operated outside GitLab. In this mode, you own renewal, replacement and monitoring.
1. Disable integrated Let’s Encrypt
In /etc/gitlab/gitlab.rb, set:
external_url "https://gitlab.example.com"
letsencrypt['enable'] = falseDisabling the integrated client prevents GitLab from trying to issue a second certificate or overwriting your intended configuration.
2. Create the default certificate directory
sudo install -d -m 700 /etc/gitlab/sslThe default directory is /etc/gitlab/ssl. Use a different location only when your GitLab version and NGINX settings explicitly support it.
3. Install the private key and complete chain
Copy the private key and certificate material into the directory. A conventional naming pattern is:
sudo cp gitlab.example.com.key /etc/gitlab/ssl/
sudo cp gitlab.example.com.crt /etc/gitlab/ssl/The certificate file must contain the complete chain in this order:
- The server certificate for
gitlab.example.com. - Every intermediate CA certificate, from the issuing intermediate upward.
- The root CA certificate, when your certificate authority instructs you to include it.
An incorrectly ordered or incomplete chain commonly produces browser warnings, Git client failures and API clients that cannot build a trust path even though the leaf certificate itself appears valid.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
4. Set restrictive permissions
sudo chown root:root /etc/gitlab/ssl/gitlab.example.com.key
sudo chmod 600 /etc/gitlab/ssl/gitlab.example.com.key
sudo chown root:root /etc/gitlab/ssl/gitlab.example.com.crt
sudo chmod 644 /etc/gitlab/ssl/gitlab.example.com.crtThe key should be readable only by root (mode 600). The public certificate can use mode 644. Preserve ownership and permissions whenever an automated renewal job replaces the files.
5. Handle an encrypted private key
If the key is encrypted with a passphrase, NGINX needs a way to read that passphrase during reconfiguration and startup. Configure gitlab_rails['nginx']['ssl_password_file'] to a protected file containing the passphrase, then secure that file as you would the key. Without this setting, NGINX cannot obtain the password and reconfigure or startup can fail. An unencrypted key avoids interactive startup but increases the importance of filesystem access controls.
6. Apply the configuration
sudo gitlab-ctl reconfigureThen test the site from a client and inspect the live chain. If you replace only certificate contents and do not change the GitLab configuration, a graceful NGINX reload is sufficient:
sudo gitlab-ctl hup nginxWhen the container registry certificate also changed, reload the registry service:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo gitlab-ctl hup registryTerminate TLS at a reverse proxy or load balancer
An external proxy can own the public certificate while GitLab receives ordinary HTTP on a protected backend network. This avoids duplicating certificates on every GitLab node, but the proxy must preserve the original request identity.
Configure bundled NGINX for HTTP backend traffic
In /etc/gitlab/gitlab.rb, a basic backend configuration is:
external_url "https://gitlab.example.com"
gitlab_rails['nginx']['listen_port'] = 80
gitlab_rails['nginx']['listen_https'] = falseReconfigure after saving:
sudo gitlab-ctl reconfigureThe external proxy should listen on 443, present the certificate, and forward requests to the GitLab host on port 80. Restrict backend access so the HTTP listener is not exposed directly to untrusted networks.
Forward the headers GitLab needs
The proxy must preserve the public request context. Forward the original Host, X-Forwarded-Ssl, X-Forwarded-For and X-Forwarded-Port headers as required by your proxy and GitLab version. The public host must remain gitlab.example.com, and the forwarded scheme must indicate HTTPS.
Missing or contradictory forwarded headers can cause endless redirects, links that switch to HTTP, failed login callbacks, or “422 Unprocessable Entity” and CSRF errors. Check the proxy’s header rewrite rules before changing GitLab application settings; a header indicating HTTPS while the proxy actually sends plain HTTP to the wrong port can create a different failure.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Validate the proxy path
- Open the public HTTPS URL and confirm that the browser shows the proxy’s expected certificate.
- Confirm that GitLab-generated links remain HTTPS.
- Log in, create a test project and perform a Git clone and push over HTTPS.
- Inspect proxy and GitLab logs if requests are redirected, rejected with 422, or lose the original client address.
Private, air-gapped and internal-CA installations
Public certificate authorities cannot validate a name that is not publicly resolvable or a server that cannot receive the challenge. For a private or air-gapped GitLab, disable integrated Let’s Encrypt and install a certificate issued by your internal CA or by an ACME service reachable from that network.
GitLab’s offline guidance recommends using a domain rather than an IP address because a domain gives the certificate a stable identity. Choose a name that resolves consistently for every user, runner and automation client that must connect. Distribute the internal CA root to operating systems, browsers, Git clients, runners and container hosts; otherwise those clients will report an untrusted issuer even when the server chain is correctly ordered.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If an internal ACME service is used, configure the ACME endpoint supported by your GitLab version or manage issuance externally and place the resulting key and chain in the Omnibus SSL directory. Establish an offline renewal procedure and a monitored transfer path for replacing files before expiration.
Helm and Kubernetes deployments use ingress TLS
A GitLab deployment installed with Helm does not use the Omnibus certificate directory. TLS is represented by Kubernetes Ingress or Gateway configuration. Usually you reference an existing Kubernetes Secret containing the certificate and key, or configure cert-manager to obtain and renew a certificate.
For public names, cert-manager can use a Let’s Encrypt HTTP-01 solver when the ingress is reachable for validation. The ingress controller, DNS record, firewall and solver configuration must all route the challenge to the correct service. Keep the certificate secret in the namespace and follow your cluster’s access-control policy.
Do not copy /etc/gitlab/ssl paths or gitlab-ctl reconfigure commands into a Helm deployment. Apply the chart’s ingress or Gateway values, inspect the resulting Kubernetes resources, and renew or rotate the referenced Secret according to the cluster’s certificate workflow.
Self-compiled GitLab installations
Source-built GitLab installations use the HTTPS GitLab URL and a web-server configuration such as the documented gitlab-ssl NGINX example. Certificate paths, service users and reload commands depend on how you compiled and deployed the application. Configure the web server to present the complete chain, protect the private key, and pass the original scheme and host to GitLab when another proxy is in front.
Do not assume Omnibus defaults, including /etc/gitlab/gitlab.rb, exist in a self-compiled installation. Identify the active NGINX configuration and the process supervisor before replacing certificates.
Verify the live certificate and chain
Verification should test what a client receives, not only what exists on disk. GitLab’s embedded OpenSSL is available on an Omnibus host:
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
echo | /opt/gitlab/embedded/bin/openssl s_client -connect gitlab.example.com:443Read the output for the presented subject, issuer, validity dates and verification status. To inspect a local certificate file:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match/opt/gitlab/embedded/bin/openssl x509 -in /path/to/certificate.crt -text -nooutCheck the following before declaring the setup complete:
- The certificate’s subject-alternative name includes the exact FQDN users access.
- The expiration date leaves enough operational margin for renewal and incident response.
- The issuer chain is complete and appears in the intended order.
- The live endpoint on port 443 presents the new certificate, not a stale proxy or old NGINX process.
- HTTP behavior matches your policy: redirect to HTTPS when enabled, or deliberate HTTP-only backend behavior when a proxy terminates TLS.
- Git operations, API calls, webhooks, runners and the container registry work with the same hostname.
Troubleshoot common failures
ACME validation cannot reach the server
Recheck public DNS, NAT, firewall rules and port 80. Make sure an external proxy is not intercepting the HTTP-01 challenge incorrectly. If the host is private or air-gapped, stop retrying public issuance and use an internal CA or reachable private ACME endpoint.
The browser reports an incomplete chain
Rebuild the manual certificate file with the server certificate first, followed by all intermediates and then the root when required by the authority. Reload NGINX after replacing the file and inspect the live endpoint again.
Reconfigure fails while reading the key
Confirm that the key path, owner and mode are correct. For an encrypted key, verify gitlab_rails['nginx']['ssl_password_file'] points to a readable, protected passphrase file. Remove accidental line breaks or a mismatched key and certificate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Users are redirected repeatedly or receive HTTP links
This usually indicates disagreement between external_url, the proxy’s TLS state and forwarded headers. Ensure the public URL is HTTPS, the proxy forwards the original host and HTTPS indication, and bundled NGINX is configured for the intended backend port.
Requests return 422 or CSRF errors behind a proxy
Check Host, X-Forwarded-Ssl, X-Forwarded-Port and X-Forwarded-For at the proxy. A missing port or a scheme that says HTTP when the browser used HTTPS can make GitLab reject the request as unsafe.
The registry still presents an old certificate
Reload the registry after changing its certificate:
sudo gitlab-ctl hup registryThen connect to the registry’s actual hostname and port and inspect the certificate separately from the main GitLab web endpoint.
Recommended Free Tools
Security settings to understand after HTTPS works
GitLab documents HTTP Strict Transport Security (HSTS) as enabled by default for the main application. The documented default max_age is 63,072,000 seconds, or two years. HSTS tells compliant browsers to use HTTPS for the policy’s lifetime, so test every required hostname and subdomain before enabling a broader policy or submitting a domain to a preload list.
HTTPS protects traffic in transit; it does not replace account security, runner hardening, access controls, patching, backups or secret rotation. Keep the private key out of source control and limit shell access to administrators who need it.
Quick Recap
Operational checklist
- Choose a stable FQDN and confirm DNS behavior for the intended audience.
- Identify whether bundled NGINX, an external proxy, Kubernetes ingress or a self-compiled web server terminates TLS.
- For Omnibus, set
external_urlto the HTTPS FQDN in/etc/gitlab/gitlab.rb. - Use integrated ACME only when public validation can reach ports 80 and 443; otherwise disable it and use an internal or manually managed certificate.
- For a manual certificate, install the server certificate plus intermediates in the correct order, protect the key with mode 600 and use mode 644 for the certificate.
- Run
sudo gitlab-ctl reconfigure, or reload NGINX and the registry after content-only certificate changes. - Verify the live chain with
/opt/gitlab/embedded/bin/openssl s_clientand inspect local files withopenssl x509. - Test browser access, Git over HTTPS, API clients, webhooks, runners and the registry.
- Monitor expiration and renewal logs, especially for 90-day ACME certificates.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
