how to solve this errror "certificate relies on legacy Common Name field, use SANs instead" during gitlab runner registration?

user_5724677 0
Viewed 928

I try to register a gitlab runner on my gtilab server and got this error : " x509: certificate relies on legacy Common Name field, use SANs instead".

I read a lot's of web pages, but i am confused to solve my problem.

  • I installed gitlab using this link : gitlab install for ubuntu .
  • On my gitlab, I looked at the page "settings-CI/CD-Runners "show runner installation"
  • I executed the command "sudo gitlab-runner register --url https://myGitlab.com/ --registration-token my token

I read the following pages to find a solution:

I understood that I should generate a new certtificate for "the system" or for gitlab. Is that right ?

What is the simpler solution : to change the "system certificate" (as explained gitlab documentation) or to create a dedicated certificate for gitlab ?

But where is stored the system certificate on ubuntu ? or where do i define a custom certificate for the gitlab server ?

And last question : how to generate a good certificate ?

There is also this answer Troubleshooting - Setting up private GitLab server and connecting Gitlab Runners . Did someone test it ?

A great thanks for any helps.

gitlab-ci ubuntu
1 Answers

It took me sometimes and the following cook book solved my problem. After all commands, i am able to run the following simple pipeline.

stages:
   - build
   - test
   - test2
   - deploy

build-job:
  stage: build
  script:
    - echo "Hello, $GITLAB_USER_LOGIN!"

test-job1:
  stage: test
  script:
    - echo "This job tests something"

test-job2:
  stage: test
  script:
    - echo "This job tests something, but takes more time than test-job1."
    - echo "After the echo commands complete, it runs the sleep command for 20 seconds"
    - echo "which simulates a test that runs 20 seconds longer than test-job1"
    - sleep 20

deploy-prod:
  stage: deploy
  script:
    - echo "This job deploys something from the $CI_COMMIT_BRANCH branch."

The registered runner is a shell runner using root as user to execute commands. see shell runner

In the following, the linux user is myUser, gitlab url is mygitlab-site.com, the gitlab project is myProject, the runner token is A_TOKEN (this token is found on page settings-CI/CD-Runners).

The start point of the cook book is :

  • Gitlab is deployed on your own server
  • the hosts file has been updated to define something like DNS entry "XXX.XXX.XX.XXX mygitlab-site.com
  • A gitlab runner is installed using settings-CI/CD-Runners "show runner installation"
  • you are connected on ubuntu as myUser

Goals are:

  • to create a dummy Certification Authority
  • to create a certificate with a Subject Alternative Name (SAN)
  • to put these certificates in gitlab certificates folder
  • to allow root to connect using ssh
  • to fixed the knonwn hosts list of root
  • to add the dummy Certification Authority in the certification authorities folder of the system
  • to register the runner
cd ~
openssl rand -writerand .rnd
chmod a+rwx ~myUser/.rnd
cd /tmp
mkdir essai
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 365 -key ca.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=Acme Root CA" -out ca.crt
openssl req -newkey rsa:2048 -nodes -keyout server.key -subj "/C=CN/ST=GD/L=SZ/O=Acme, Inc./CN=*mygitlab-site.com" -out server.csr
openssl x509 -req -extfile <(printf "subjectAltName=DNS:mygitlab-site.com") -days 365 -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt
sudo cp * /etc/gitlab/ssl
cd /etc/gitlab/
sudo mkdir bck-ssl
cd ssl
sudo mv  mygitlab-site.com.crt  mygitlab-site.com.key ../bck-ssl/
sudo mv server.crt mygitlab-site.com.crt
sudo mv server.key mygitlab-site.com.key
sudo rm server.csr
sudo gitlab-ctl restart
sudo passwd root
sudo vi /etc/ssh/sshd_config ( use https://www.ubuntu18.com/ssh-permitrootlogin/)
sudo systemctl restart sshd.service
su - root (connect as root)
cd ~
cd .ssh
ssh-keygen -t rsa
chmod 600 id_rsa
chmod 644 id_rsa.pub
echo > known_hosts
chmod 600 known_hosts
cd ..
chmod 600 .ssh
git clone git@mygitlab-site.com:myUser/myProject.git (tip to update the known hosts list)
quit root user
cd /etc/gitlab/ssl
sudo cp ca.crt ca.pem
sudo cp ca.pem /etc/ssl/certs/ca.pem
su - root (connect as root)
cd /etc/ssl/certs/
update-ca-certificates
quit root user
sudo gitlab-ctl restart
sudo gitlab-runner register --tls-ca-file=/etc/gitlab/ssl/ca.crt --url https://mygitlab-site.com/ --registration-token A_TOKEN
user_57246770
Related