Enabling HTTPS broke my Gitea server

[donbecker]

• Gitea version (or commit ref): 1.0.1, windows-4.0-amd64
• Git version: 2.10.2
• Operating system: Win Server 2016
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

https://gist.githubusercontent.com/donbecker/e07fd5b6ee4c72b8961dec3babbe1828/raw/e551d9c4bb6dc7e23f8713f938057e9139d5d0f9/gogs.log

Description

-attempted to push from my local workstation to gitea repo for first time via HTTP (I'm using this on a local intranet server).
-this failed even though I cleared all other ssh keys, and entered valid creds for Gitea
-attempted to configure Gitea for HTTPS: https://gogs.io/docs/intro/faqs#how-do-i-set-up-https%3F
-navigating to Gitea I now get a self-signed cert warning, accepting it I get a 500 internal server error.
-attempted to remove HTTPS configuration and revert to previous config, restarted service, I still get a 500 Internal Server error.

[donbecker]

Strangely enough, the logs don't show the 500 error.

[donbecker]

More testing by completely deleting the gitea folder and reinstalling, it seems that almost any change to my config file will cause the server to return 500's upon restarting the service. I've made sure that my gitea directory and all files are owned by the user that the service is running as.

[tboerger]

Have you checked the permissions of the certs? Have you verified that the path to your certs is correct? Please show the app.ini.

[donbecker]

Hi, I now have Gitea running on Win Server 2016 with a self-signed cert.

• log into server as Gitea service account

• generate self signed certs with Gitea.exe:
  Powershell as Admin> cd C:\gitea
  Powershell as Admin> .\gitea.exe cert -ca=true -duration=8760h0m0s -host=(server FQDN)
  -move certs (key.pem & cert.pem) from c:\gitea to c:\gitea\custom\https

• Fix Folder & Objects owner:
  c:\gitea, right click, security tab, click Advanced
  owner, change -> (domain service account)
  check "replace owner..."
  check "replace all child..."
  click apply

• Fix Folder & Objects permissions:
  rightclick -> properties -> security -> edit
  CREATOR OWNER: all unchecked except "allow:special permissions", which is checked and greyed out
  SYSTEM: all deny unchecked, all allow checked and greyed out, except "allow:special permissions" which is unchecked
  svcgitea(domain service account): all allow checked, except "allow:special permissions", which is checked and greyed out
  Administrators(servername\Administrators): all deny unchecked, all allow checked and greyed out, except "allow:special permissions" which is unchecked
  Users(servername\Users): all deny unchecked, all allow checked and greyed out, except "allow:write", "allow:full control" and "allow:modify" which are unchecked

• Update app.ini file [server] section:

[server]
SSH_DOMAIN = localhost
HTTP_PORT = 3000
ROOT_URL = https://(serverFQDN):3000/
DISABLE_SSH = false
SSH_PORT = 22
OFFLINE_MODE = false
PROTOCOL = https
CERT_FILE = C:/gitea/custom/https/cert.pem
KEY_FILE = C:/gitea/custom/https/key.pem

I am now able to access Gitea server over HTTPS (accepting the self signed certificate).

I think I've got the same/ similar question
my config is

[server]
APP_DATA_PATH    = /data/gitea
SSH_DOMAIN       = foo.com
HTTP_PORT        = 3000
ROOT_URL         = https://foo.com:3000
DISABLE_SSH      = false
SSH_PORT         = 22
DOMAIN           = foo.com
LFS_START_SERVER = true
LFS_CONTENT_PATH = /data/gitea/lfs
LFS_JWT_SECRET   = ...
OFFLINE_MODE     = false
PROTOCOL = https
CERT_FILE = custom/https/cert.pem
KEY_FILE = custom/https/key.pem
ENABLE_GZIP = true


[database]
PATH     = /data/gitea/gitea.db
DB_TYPE  = sqlite3
HOST     = localhost:3306
NAME     = gitea
USER     = root
PASSWD   =
SSL_MODE = disable

[session]
PROVIDER_CONFIG = /data/gitea/sessions
PROVIDER        = file
COOKIE_SECURE = true

setting it to

ROOT_URL         = http://foo.com:3000
#PROTOCOL = https
#CERT_FILE = custom/https/cert.pem
#KEY_FILE = custom/https/key.pem
COOKIE_SECURE = false

works perfectly fine

I have got a cert.pem and key.pem file generated using openssl in the respective folders yet I get foo.com has refused the connection in chrome and safari tells me it can't create a secure connection... (to https://foo.com:3000)

on docker-compose up I get

server_1  | chown: unknown user/group git:git
server_1  | 2018/03/29 23:25:43 [T] AppPath: /app/gitea/gitea
server_1  | 2018/03/29 23:25:43 [T] AppWorkPath: /app/gitea
server_1  | 2018/03/29 23:25:43 [T] Custom path: /data/gitea
server_1  | 2018/03/29 23:25:43 [T] Log path: /data/gitea/log
server_1  | WARNING: ca-certificates.crt does not contain exactly one certificate or CRL: skipping

although this is roughly what I get without https, the ca-certificate seems to be a alpine linux thing

would appreciate any help! thanks

[lafriks]

Is it self-signed certificate or signed with your custom CA certificate?

It‘s self signed.
The thing that concerns me is that my browsers do not even ask like „do you want to trust this...“
And docker-compose up does not report „listening on...“ which led me to believe the Server might not be starting up properly and my config could be broken.
On the other hand everything seems pretty straight forward so not sure what is going on.

edited to add: I used openssl req -newkey rsa:2048 -new -nodes -keyout key.pem -out cert.pem on my server where I deploy the docker image

and more info from the startup in case that helps: (I just used weird names, just first wanted to test things out)
the unknown user error, I think it comes from the fact that the user where the /gitea folder is located is not named git but it works fine for the non https case anyhow so I've not yet further gone down that road

Creating network "gitea_gitea" with the default driver
Creating gitea_server_1
Attaching to gitea_server_1
server_1  | id: unknown user git
server_1  | Mar 30 12:11:17 syslogd started: BusyBox v1.27.2
server_1  | /etc/ssh/sshd_config line 32: Deprecated option UsePrivilegeSeparation
server_1  | Mar 30 12:11:17 sshd[18]: Server listening on :: port 22.
server_1  | Mar 30 12:11:17 sshd[18]: Server listening on 0.0.0.0 port 22.
server_1  | WARNING: ca-certificates.crt does not contain exactly one certificate or CRL: skipping
server_1  | chown: unknown user/group git:git
server_1  | 2018/03/30 12:11:17 [T] AppPath: /app/gitea/gitea
server_1  | 2018/03/30 12:11:17 [T] AppWorkPath: /app/gitea
server_1  | 2018/03/30 12:11:17 [T] Custom path: /data/gitea
server_1  | 2018/03/30 12:11:17 [T] Log path: /data/gitea/log
server_1  | WARNING: ca-certificates.crt does not contain exactly one certificate or CRL: skipping

I also tried a simple golang FileServer with https and self signed certificates and it worked so it does not seem to be an issue with my browser either.

... anyone? 💬