OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)):

[chandu412]

Hello!

We are trying to integrate keycloak with Gitlab using OmniAuth without SSL applied(mandatory requirement). The configuration of the gitlab.rb file is as follows,

prometheus_monitoring['enable'] = false
gitlab_rails['ldap_enabled'] = false;
nginx['listen_port'] = 10200
nginx['listen_http'] = false
registry_nginx['enable'] = true
gitlab_rails['registry_path'] = "/mnt/docker_registry"
registry['enable'] = true
registry_external_url 'http://localhost:8123'
external_url 'http:///gitlab/'
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_providers'] = [
{ 'name' => 'Keycloak',
'label' => 'Login',
'args' => {
'name' => 'openid_connect',
'scope' => ['openid','profile',''],
'response_type' => 'code',
#'issuer' => 'http:///auth/realms/',
'discovery' => true,
'client_auth_method' => 'query',
'send_scope_to_token_endpoint' => 'false',
'client_options' => {
'port' => 80,
'scheme' => 'http',
'host' => '/auth',
'identifier' => '<CLIENT_ID>',
'secret' => '<CLIENT_SECRET>',
'redirect_uri' => 'http:///gitlab/users/auth/openid_connect/callback',
}
}
}
]
gitlab_rails['omniauth_sync_profile_from_provider'] = 'Keycloak'
#gitlab_rails['omniauth_auto_sign_in_with_provider'] = 'openid_connect'
gitlab_rails['omniauth_allow_single_sign_on'] = ['Keycloak']
gitlab_rails['omniauth_auto_link_saml_user'] = true
gitlab_rails['omniauth_block_auto_created_users'] = false

We are getting the following error when we login to the UI -> go to user settings ->
Account -> click on Connect OpenID Connect option,

OpenSSL::SSL::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)):

Can someone help us fix this?

Thanks in advance :)

[kimat]

@chandu412 it's related to this issue nahi/httpclient#369

Here's one solution used at gitlab: https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/30749

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.