SSL/TLS Security Enhancements

9/18/2024

This post announces the upgrade of the GitLab Linux package to OpenSSL 3 in GitLab 17.7. This change impacts outbound connections from self-managed instances, requiring TLS 1.2 or above and at least 112-bit encryption for TLS certificates. It provides guidance for administrators to check external integrations and update TLS configurations, and explains the security rationale behind the upgrade, including the end-of-life of OpenSSL 1.1.1.

10/12/2023

This post details GitLab's investigation and response to the curl and libcurl security vulnerability (CVE-2023-38545). It confirms that GitLab.com and GitLab Dedicated environments are not affected due to the absence of SOCKS5 proxy configuration. For self-managed customers using SOCKS5 proxies with GitLab, the post advises upgrading to curl version 8.4.0. The security and development teams proactively scoped the usage of curl and libcurl across the GitLab environment to assess potential impact.

11/1/2022

This post details the discovery and mitigation of specific X.509 email address buffer overflow vulnerabilities (CVE-2022-3786 and CVE-2022-3602) in OpenSSL 3.0, emphasizing the need to upgrade to OpenSSL 3.0.7 and how GitLab's dependency scanning and DAST analyzer were used to assess and patch the vulnerability within its own systems.

11/8/2019

This post details a near-outage on GitLab.com caused by expired TLS certificates for Consul, a service discovery tool. The incident highlighted the critical importance of certificate lifecycle management, especially for self-signed certificates used in proof-of-concept environments that are later promoted to production. The team successfully navigated the crisis by validating the problem, testing solutions in staging, and planning a 'break glass' approach using the `at` command for simultaneous service restarts across a large fleet of servers. The chosen solution involved temporarily disabling certificate validation to avoid downtime, with a plan to implement a more robust solution later.

12/17/2018

This post announces the discontinuation of support for TLS 1.0 and 1.1 on GitLab.com and the GitLab API, mandating TLS 1.2 for all client connections. It cites PCI DSS 3.1 compliance and security vulnerabilities of older TLS versions as reasons. It also outlines specific client incompatibilities (Git-Credential-Manager-for-Windows prior to 1.14.0, Git on older Red Hat versions, JGit/Java releases < JDK 8, older Visual Studio versions) and provides remediation steps, primarily advising updates to newer versions or operating systems.

11/15/2018

This post announces the deprecation of TLS 1.0 and 1.1 support on GitLab.com and the GitLab API by December 15, 2018. It provides a canary environment ([canary.gitlab.com](https://canary.gitlab.com/)) for users to test their integrations, API tokens, and browsers for TLS 1.2 compatibility. It also lists identified client incompatibilities, including Git-Credential-Manager-for-Windows prior to 1.14.0, Git on older Red Hat versions, JGit/Java releases < JDK 8, and older Visual Studio versions, advising on necessary updates.

10/15/2018

This post announces the deprecation of TLS 1.0 and TLS 1.1 on GitLab.com and its API by December 15, 2018. It cites security vulnerabilities (e.g., Heartbleed) and PCI DSS 3.1 compliance as reasons. It also details specific client incompatibilities with TLS 1.2, including Git-Credential-Manager-for-Windows prior to 1.14.0, Git on older Red Hat versions, JGit/Java releases < JDK 8, and older versions of Visual Studio.

4/11/2016

This post introduces the practical implementation of securing GitLab Pages with TLS/SSL certificates obtained from Let's Encrypt. It details the benefits of TLS/SSL beyond just transaction security, explains how to obtain free certificates, and provides a step-by-step tutorial for configuring custom domains on GitLab Pages to use these certificates. This significantly enhances the security and trustworthiness of user-hosted static websites.

6/17/2015

This post details the technical decision-making process and implementation for updating GitLab.com's SSL cipher suite to address the Logjam vulnerability. It explains the trade-offs considered, specifically the compatibility issues with older Java-based clients when using 2048-bit DHE parameters. The post outlines the investigation into removing DHE suites entirely, the observed results (improved SSL Labs score to 'A', continued forward secrecy via ECDHE for most clients, but loss of forward secrecy for specific older clients), and the final decision to remove DHE suites from GitLab.com. It also mentions updating recommended configurations for omnibus-gitlab packages and source installations.

5/21/2015

This post provides detailed instructions for self-managed GitLab installations to mitigate the Logjam vulnerability by generating and configuring 2048-bit DH parameters in Nginx. It outlines specific steps for Omnibus packages (versions 7.11.0 and up, and prior to 7.11.0) and installations from source. It also addresses the impact on GitLab.com, noting the current use of 1024-bit DH groups due to compatibility concerns with older Java clients and the ongoing investigation into solutions.