mkdir /root/data
cd /root/data

# 创建自已的CA证书
openssl req -newkey rsa:4096 -nodes -sha256 -keyout ca.key -x509 -days 3650 -out ca.crt
#------------------------------------------------------------
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Harbin
Locality Name (eg, city) []:Harbin
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ydgw
Organizational Unit Name (eg, section) []:ydgw
Common Name (e.g. server FQDN or YOUR name) []:10.240.4.160
Email Address []:liuyajun@ydgw.cn
#------------------------------------------------------------

# 生成一个证书签名请求
openssl req -newkey rsa:4096 -nodes -sha256 -keyout 10.240.4.160.key -out 10.240.4.160.csr
#------------------------------------------------------------
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Harbin
Locality Name (eg, city) []:Harbin
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ydgw
Organizational Unit Name (eg, section) []:ydgw
Common Name (e.g. server FQDN or YOUR name) []:10.240.4.160
Email Address []:liuyajun@ydgw.cn

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:   #密码留空即可
An optional company name []:
#------------------------------------------------------------

# 创建文件夹和辅助内容
mkdir demoCA
cd demoCA
touch index.txt
echo '01' > serial
cd ..

ll
#------------------------------------------------------------
total 28
drwxr-xr-x 3 root root 4096 Feb  5 17:03 ./
drwx------ 6 root root 4096 Feb  5 17:00 ../
-rw-r--r-- 1 root root 1740 Feb  5 17:02 10.240.4.160.csr
-rw-r--r-- 1 root root 3272 Feb  5 17:02 10.240.4.160.key
-rw-r--r-- 1 root root 2098 Feb  5 17:01 ca.crt
-rw-r--r-- 1 root root 3276 Feb  5 17:01 ca.key
drwxr-xr-x 2 root root 4096 Feb  5 17:03 demoCA/
#------------------------------------------------------------

# 签名证书
echo subjectAltName = IP:10.240.4.160 > extfile.cnf
openssl ca -in 10.240.4.160.csr -out 10.240.4.160.crt -cert ca.crt -keyfile ca.key -extfile extfile.cnf -days 3650 -outdir .
#------------------------------------------------------------
Using configuration from /usr/lib/ssl/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Feb  5 09:03:38 2018 GMT
            Not After : Feb  5 09:03:38 2019 GMT
        Subject:
            countryName               = CN
            stateOrProvinceName       = Harbin
            organizationName          = ydgw
            organizationalUnitName    = ydgw
            commonName                = 10.240.4.160
            emailAddress              = liuyajun@ydgw.cn
        X509v3 extensions:
            X509v3 Subject Alternative Name: 
                IP Address:10.240.4.160
Certificate is to be certified until Feb  5 09:03:38 2019 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
#------------------------------------------------------------

ll
#------------------------------------------------------------
total 48
drwxr-xr-x 3 root root 4096 Jan 30 22:20 ./
drwx------ 5 root root 4096 Jan 30 22:09 ../
-rw-r--r-- 1 root root 6873 Feb  5 17:03 01.pem
-rw-r--r-- 1 root root 6873 Feb  5 17:03 10.240.4.160.crt
-rw-r--r-- 1 root root 1740 Feb  5 17:02 10.240.4.160.csr
-rw-r--r-- 1 root root 3272 Feb  5 17:02 10.240.4.160.key
-rw-r--r-- 1 root root 2098 Feb  5 17:01 ca.crt
-rw-r--r-- 1 root root 3276 Feb  5 17:01 ca.key
drwxr-xr-x 2 root root 4096 Feb  5 17:03 demoCA/
-rw-r--r-- 1 root root   33 Feb  5 17:03 extfile.cnf
#------------------------------------------------------------

# 证书加入本机信任
cp 10.240.4.160.crt /usr/local/share/ca-certificates/
update-ca-certificates

# 重启docker使证书生效
systemctl daemon-reload
systemctl restart docker

# 将证书放到指定的路径
mkdir /data/gitlab/conf-files/ssl
chmod 700 /data/gitlab/conf-files/ssl
cp /root/data/10.240.4.160.crt /data/gitlab/conf-files/ssl/
cp /root/data/10.240.4.160.key /data/gitlab/conf-files/ssl/

vi /data/gitlab/conf-files/gitlab.rb
# 添加以下内容在文件的最后
#------------------------------------------------------------
external_url "https://10.240.4.160"
nginx['enable'] = true
nginx['redirect_http_to_https'] = true
nginx['ssl_certificate'] = "/etc/gitlab/ssh/10.240.4.160.crt"
nginx['ssl_certificate_key'] = "/etc/gitlab/ssh/10.240.4.160.key"
#------------------------------------------------------------