使用https和客户端请求Gitlab时报证书的错误：unable to verify the first certificate

给VSCode装了一个gitlab的插件，但是无法登录，报错如下：

: Extracted urls: []
: Extracted urls: []
: More recent project update in progress, discarding findings for urls: []
: Found 0 projects for urls: []
[error]: {
           "userMessage": "Request failed: Can't add GitLab account for https://git.yangyq.net. Check your instance URL and network connection.",
           "errorMessage": "request to https://git.yangyq.net/api/v4/user failed, reason: unable to verify the first certificate",
           "stack": [
             "FetchError: request to https://git.yangyq.net/api/v4/user failed, reason: unable to verify the first certificate",
             "\tat ClientRequest.<anonymous> (c:\\Users\\Yongquan\\.vscode\\extensions\\gitlab.gitlab-workflow-3.47.2\\out\\extension.js:4:338866)",
             "\tat ClientRequest.emit (node:events:402:35)",
             "\tat TLSSocket.socketErrorListener (node:_http_client:447:9)",
             "\tat TLSSocket.emit (node:events:390:28)",
             "\tat emitErrorNT (node:internal/streams/destroy:157:8)",
             "\tat emitErrorCloseNT (node:internal/streams/destroy:122:3)",
             "\tat processTicksAndRejections (node:internal/process/task_queues:83:21)"
           ]
         }

能够看出是证书的问题。

大概的原因是证书链设置的不对，本地客户端没有根证书，因此无法进行通信，实际上，如果证书下载的是Nginx版本，证书链就已经设置好了，可以直接使用。

首先申请证书，最好是从阿里云等公司，申请正规的CA证书，不要用自签证书。下载证书，注意下载Nginx版本。

把文件夹中的pem和key文件，上传到服务器。

证书存放目录：

/etc/gitlab/ssl/

修改gitlab自带的nginx的配置文件：

/etc/gitlab/gitlab.rb

修改其中的证书配置：

nginx['enable'] = true
nginx['ssl_certificate'] = "/etc/gitlab/ssl/git.yangyq.net.crt"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/git.yangyq.net.key"

如果下载回来的证书不是crt格式，是pem格式，则上述地址改为.pem。或者将pem文件改为crt文件，也可以。

然后，重新配置和重启gitlab：

gitlab-ctl reconfigure
gitlab-ctl restart