TechPrufer
Sign inGet started

Blogs›GitLab›TLS Security and Configuration

TLS Security and Configuration

TLS Security and Configuration

5
posts
2015–2022

GitLab has consistently focused on enhancing the security of its platform, particularly concerning TLS (Transport Layer Security) configurations. This has involved addressing vulnerabilities and providing guidance on upgrading encryption. A significant evolution has been the integration and simplification of obtaining and applying TLS certificates for custom domains, especially through the adoption of free, automated services like Let's Encrypt for GitLab Pages. This ensures data integrity, authentication, and confidentiality. This post details the process of securing GitLab Pages with free StartSSL Class 1 certificates, comparing them to Let's Encrypt and outlining the steps for domain verification and certificate installation, while also noting the recent distrust of StartCom certificates by major browsers and StartCom's efforts to resolve the issue.

2022

GitLab and Let's Encrypt partner to improve website security

9/29/2022

This post details the integration of Let's Encrypt with GitLab Pages to automate the acquisition and application of TLS certificates for custom domains. It explains the technical concepts of TLS and how it secures web traffic. The post provides a step-by-step guide for users to enable automatic certificate management via Let's Encrypt within their GitLab project settings, including the option to force HTTPS. It highlights the benefits of this integration for improving website security and user privacy.

2017

Setting up GitLab Pages with Cloudflare Certificates

2/7/2017

This post details the technical steps required to configure GitLab Pages with custom domains using Cloudflare SSL/TLS certificates. It outlines the process of setting up DNS records (CNAME or A) to point to GitLab Pages, generating a certificate and private key via Cloudflare's Crypto tab, and then adding these to the GitLab Pages project settings. The key technical contribution is the 'trick' of concatenating the Cloudflare Origin CA certificate below the user's generated PEM certificate in GitLab's settings to ensure proper validation when Cloudflare's SSL is set to 'Full' or 'Full (strict)'.

2016

Secure GitLab Pages with StartSSL

6/24/2016

This post details the process of securing GitLab Pages with free StartSSL Class 1 certificates. It provides an overview of HTTPS, StartCom CA, and StartSSL Class 1 features and limitations. It also includes a comparison between StartSSL Class 1 and Let's Encrypt, and a step-by-step guide for securing GitLab Pages with StartSSL certificates. The post also includes an update regarding the distrust of StartCom certificates by Mozilla Firefox and Google Chrome.

Tutorial: Securing your GitLab Pages with TLS and Let's Encrypt

4/11/2016

This post details the technical steps for securing GitLab Pages with TLS using Let's Encrypt. It explains the importance of TLS/SSL for authentication, data integrity, and encryption, even for static sites. The implementation guide covers setting up a Jekyll site, configuring GitLab CI for deployment, and the manual process of obtaining and validating a Let's Encrypt certificate for a custom domain by serving a specific token. It also addresses the browser's mixed content warnings when using a custom domain with the default `*.gitlab.io` certificate and provides instructions for uploading the obtained certificate and key to GitLab Pages settings.

2015

Security advisory for Logjam vulnerability

5/21/2015

This post addresses the Logjam vulnerability, detailing its impact on GitLab and providing specific instructions for users to mitigate the risk by upgrading Diffie-Hellman (DH) group sizes. It offers configuration steps for both GitLab installations using Omnibus packages and those installed from source, including workarounds for older Omnibus versions. For GitLab.com, it explains the current configuration and the challenges in upgrading to 2048-bit DH groups due to compatibility concerns with older Java clients, indicating an ongoing investigation into solutions.