self signed certificate for git repo

[due-abracoma]

Hi everyone
I have a git repo (Azure DevOps) with a self signed ssl certificate configured in ansible semaphore running on Ubuntu 22.04.
When I try to start a playbook, I get the error that the 'certificate is signed by unknown authority'. I already exported the certificate and loaded it into the local certificate store on which ansible is running, but I still get the error.
Also, I tried to find an option to disable the ssl check in the web ui, but I wasn't successful.
Is there an option to use the git repo with a self signed certificate?

[ansibleguy]

Greetings!
I don't think that self-signed certificate (no CA chain at all) can be added as trusted to the system-store. (and work)
You could try to create a self-signed CA and create a new server-certificate using it.
Import the server-cert in your repo-service and add the CA pubkey as trusted.
Tool to generate an internal CA: easyrsa, how-to, short version

[helioguardabaxo]

Hi @fiftin
Do you intend to implement this functionality?

Thanks!

[fiftin]

Can you try to add environment variable GIT_SSL_NO_VERIFY=true to your Variable Group?

[fiftin]

I think it can be simply implemented by adding flag to the Repository settings.

[sladewexo]

Since upgrading to version 2.11 Semaphore keeps giving errors about the self signed certificate of my Gitlab. In version 2.10 I used to enter the command "git config --global http.sslVerify false" and it would happily work but no more in 2.11. Both Semaphore and Gitlab run as Docker containers from the same host.

A git clone via command line "git -c http.sslVerify=false clone https://..." works perfectly from within the Semaphore docker container in version 2.11.x

[fiftin]

Hm, it doesn't look like Semaphore issue. Semaphore uses Git as external app. There is no changes here in 2.11.

Can you try to add environment variable GIT_SSL_NO_VERIFY=true to your Variable Group?

[2cre8it]

I also run into the same problem with 2.11. In the previous version (2.10.22) I configured semaphore with http_proxy & https_proxy as environment variables and semaphore had no problems cloning my repositories that are located in bitbucket.org

Since the upgrade I noticed semaphore 2.11 bypasses all my proxy settings, both as environment variables and git global config, and tried to access bitbucket.org directly, which then been denied by our corporate firewall.

I also tried putting in the proxy settings (http_proxy, https_proxy) into the Variable Group when I run the task - still no good.

I'm at lost now on what and were I should configure the proxy settings.

[Rathvire]

I'm having this issue also. running on helm chart semaphore-15.1.6 and semaphore 2.14.8

Adding GIT_SSL_NO_VERIFY=true to the variable group didn't help unfortunately.

I've got the semaphore container trusting my offline CA and I can git clone the repo without issues from the terminal. Just continues to spit out the following when running tasks.

From the task output

Cloning into 'repository_1_template_1'...
fatal: unable to access 'https://gitea.example.com/example/semaphore-ansible/': SSL certificate problem: self-signed certificate in certificate chain
Failed updating repository: exit status 128
Running app failed: exit status 128

From the container
semaphore-5f6b8f5cf6-d6hhn:~$ git clone https://gitea.example.com/example/semaphore-ansible/ ./test
Cloning into './test'...
remote: Enumerating objects: 10, done.
remote: Counting objects: 100% (10/10), done.
remote: Compressing objects: 100% (8/8), done.
remote: Total 10 (delta 1), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (10/10), done.
Resolving deltas: 100% (1/1), done.