TLS Security and Configuration

6 posts · May 2015 – Sep 2022

What this trail covers

GitLab Pages now supports custom domains with TLS certificates obtained via Let's Encrypt, enhancing security and user trust by enabling HTTPS for static websites. This involves configuring DNS, obtaining certificates manually through Let's Encrypt's ACME challenge, and uploading the certificate and key to GitLab Pages settings. This post details how to use Cloudflare certificates with GitLab Pages, requiring the concatenation of the Cloudflare Origin CA certificate with the user's certificate.

All GitLab trails

Sep 2022GitLab and Let's Encrypt partner to improve website securityThis post details the integration of Let's Encrypt with GitLab Pages to automate the acquisition and application of TLS certificates for custom domains. It explains the fundamentals of TLS, how it works, and the role of Certificate Authorities. The step-by-step guide covers adding a Let's Encrypt certificate via the GitLab UI, including enabling 'Force HTTPS' for enhanced security. The contribution highlights the partnership's goal of making internet encryption more accessible and secure.
Feb 2017Setting up GitLab Pages with Cloudflare CertificatesThis post details the process of configuring GitLab Pages to use custom domains with Cloudflare SSL/TLS certificates. It outlines the steps for setting up DNS records (CNAME or A), generating certificates within Cloudflare, and crucially, the "trick" of concatenating the Cloudflare Origin CA certificate with the user's generated PEM certificate before uploading it to GitLab Pages settings. It also mentions the supported SSL/TLS encryption modes on Cloudflare ('Full' or 'Full (strict)').
Jun 2016Secure GitLab Pages with StartSSLThis post details the process of securing GitLab Pages with free StartSSL Class 1 certificates. It provides an overview of HTTPS, organizations supporting it, and a comparison between StartSSL Class 1 and Let's Encrypt, highlighting features like certificate expiration, client installation, support, and cost. It also outlines the limitations of StartSSL Class 1 and guides users through securing their GitLab Pages site with these certificates, emphasizing the use of custom domains.
Apr 2016Tutorial: Securing your GitLab Pages with TLS and Let's EncryptThis post details the manual process of obtaining and configuring a TLS certificate for a custom domain on GitLab Pages using Let's Encrypt. It covers setting up a Jekyll site, creating a `.gitlab-ci.yml` for deployment, adding a custom domain, and performing the Let's Encrypt ACME challenge by creating a specific file within the static site. It also explains the importance of TLS for authentication, data integrity, and encryption, and the browser's reaction to mixed content warnings.
May 2015Security advisory for Logjam vulnerabilityThis post addresses the Logjam vulnerability, detailing its impact on GitLab and providing specific instructions for users to mitigate the risk by upgrading Diffie-Hellman (DH) group sizes. It offers configuration steps for both GitLab installations using Omnibus packages and those installed from source, including workarounds for older Omnibus versions. For GitLab.com, it explains the current configuration and the challenges in upgrading to 2048-bit DH groups due to compatibility concerns with older Java clients, indicating an ongoing investigation into solutions.
Advertisement