To host a GitLab server over Tor I would like to get an https certificate. Gitlab provides the opportunity to use a let's encrypt certificate. Let's encrypt requires a domain for registration, hence I tried to set:

external_url 'someoniondomain.onion'​
external_url 'http://someoniondomain.onion'​
external_url 'https://someoniondomain.onion'

Followed by:

sudo gitlab-ctl reconfigure
sudo gitlab-ctl start

However, the first setting for the external_url returns:

Running handlers: There was an error running gitlab-ctl reconfigure:

GitLab external URL must include a schema and FQDN, e.g. http://gitlab.example.com/

The second and third setting for the external_url return:

Running handlers:

There was an error running gitlab-ctl reconfigure:

letsencrypt_certificate[<some_onion_domain>.onion] (letsencrypt::http_authorization line 5) had an error: Acme::Client::Error::RejectedIdentifier: acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 25) had an error: Acme::Client::Error::RejectedIdentifier: Error creating new order :: Cannot issue for "<some_onion_domain>.onion": The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy

Hence, I would like to ask, how could I get a https certificate for an onion domain?

This post seems to refer to the possibility to serve https over .onion domains, hence I thought it might be possible to generate Letsencrypt certificates in a work-around.

  • 1
    It's possible, but apparently not through LetsEncrypt. You should try a different CA. DuckDuckGo's .onion site has a DigiCert certificate, so I would try DigiCert. – fuzzy drawings May 9 at 18:44
  • @DanielB Thank you, I adjusted my question in response to your comment to ask how to get an https certificate from any certificate provider (instead of Let's encrypt only) for a .onion domain for GitLab. – Maximilian brutus III May 9 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.