Let’s Encrypt is now publicly providing free SSL certificates so I thought it would be a good time to get on and secure my Gitlab instance.
The usual web search for anyone that may have walked the road before me turned this up on Stack Overflow – which was helpful to get me thinking in the right direction, however I though I would document my steps here as I felt it wasn't all that difficult.
As Hay points out on Stack Overflow you should refer to the steps on letsencrypt.org as it is still in beta and may change.
Install Let’s Encrypt
$ git clone https://github.com/letsencrypt/letsencrypt $ cd letsencrypt
Get the certificate
So if you have ever had the joy of applying for SSL certificates before you will understand just how fantastic Let’s Encrypt really is.
./letsencrypt-auto certonly --standalone -d gitlab.example.com
… that’s it.
Ok so the first time you run Let’s Encrypt you’ll see it do a bunch of stuff as it sets up it’s Python environment and downloads dependancies—don’t worry about any of that. You then get a screen to enter your email address. But really that’s all there is, you have a valid SSL certificate in
Minor note; you may well need to stop gitlab,
gitlab-ctl stop first as Let’s Encrypt complained about not being able to use port 80. Perhaps that was just me?
/etc/gitlab/gitlab.rband make sure
external_urlnow references your domain with
http. I also set
Next update the location of your certificate and private key:
nginx['ssl_certificate'] = "/etc/letsencrypt/live/gitlab.example.com/fullchain.pem" nginx['ssl_certificate_key'] = "/etc/letsencrypt/live/gitlab.example.com/privkey.pem"
(Update the location rather than copying the files to Gitlab’s default to make renewing the certificates simpler)
- Save your changes and run
And you’re done.
Let’s Encrypt certificates are only valid for 90 days so it's recommended that you set up a script to renew them which they describe on letsencrypt.org/howitworks.