Add a CA Chain certificate for gitea for SSL

[uberlinuxguy]

• Gitea version (or commit ref): Gitea version 1.4.3 built with: bindata, sqlite
• Git version: 1.8.4
• Operating system: CentOS 6
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

I am trying to enable SSL on gitea with a certificate that requires a CA Chain certificate. I found #2744 that talks about a CA for webhooks, and thought that might help. I tried adding that certificate to the ca-trust on Cent 6 but even if I do that and restart gitea, I still cannot verify the certificate remotely using: openssl s_client -connect my.host.domain:3000 -showcerts </dev/null

This setup works with apache, but I do not understand how to add the CA Chain certificate to gitea.

[uberlinuxguy]

FWIW, I was able to "work around" the issue since I had an apache instance that worked with SSL.

I added:

<Location /git/>
                ProxyPass http://localhost:3000/
                ProxyPassReverse http://localhost:3000/
                Order deny,allow
                Deny from all
                Allow from all
 </Location>

To my port 443 configuration in apache and that let's me get around this issue.

However, it would still be nice to know how to get gitea to use a CA Chain cert correctly, since I may one day move this to a server without apache and it would be nice to not have to rely on the Proxy stuff.

I thought the apache stuff might help someone else one day though, just in case.

@lafriks would kind/question be more appropriate for the forum? Consolidating support requests in a central location ought to help in the planned dogfooding effort by severing ties with GH.

[techknowlogick]

@JHabdas If someone has a question like this it usually means that the existing documentation is insufficient to answer their question. Some questions are appropriate for discourse, however some are needed as issues so that documentation can be updated.

[techknowlogick]

@uberlinuxguy

you'll need to combine the cert with the full chain, and use the settings such as:

CERT_FILE        = fullchain.pem
KEY_FILE         = privkey.pem

[lafriks]

Closing as answered, reopen if needed