# Delegate authentication to GitLab with a custom SSL certificate

**URL:** <https://community.sonarsource.com/t/delegate-authentication-to-gitlab-with-a-custom-ssl-certificate/23019>\
**Category:** SonarQube Server / Community Build\
**Tags:** authentication, ssl, gitlab\
**Created:** [April 13, 2020, 2:20pm UTC](https://community.sonarsource.com/t/delegate-authentication-to-gitlab-with-a-custom-ssl-certificate/23019 "2020-04-13T14:20:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![hustlibraco](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/hustlibraco/32/14857_2.png) [@hustlibraco](https://community.sonarsource.com/u/hustlibraco)\
**Post date:** [April 13, 2020, 2:20pm UTC](https://community.sonarsource.com/t/delegate-authentication-to-gitlab-with-a-custom-ssl-certificate/23019/1 "2020-04-13T14:20:04Z")

</div>

Hello. I’m meeting similar problem, but not reasons you guys talked above.

I have a self-host Gitlab(version 12.9) and a self-host sonaruqbe(8.2-community), both are serving in https, self sign cert. I want to delegate Authentication with Gitlab.

- First, I created sonarqube app on gitlab.
- Second, put application id and secret in sonarqube, allow user sign-up, disable group sync.Set the right `Server base URL` .

Then I can see “Log in with GitLab” icon in login page, and get this response:  
 ![1](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/2/21d09793424d57d266b6347cf5473e12b108a3d8.png)

and web log:

> ```
> 2020.04.13 14:16:18 WARN web[AXFzahyz3CdktahgAAaD][o.s.s.a.AuthenticationError] Fail to callback authentication with 'gitlab'
> java.lang.IllegalStateException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderEx
> ception: unable to find valid certification path to requested target
> at org.sonar.auth.gitlab.GitLabIdentityProvider.callback(GitLabIdentityProvider.java:104)
> at org.sonar.server.authentication.OAuth2CallbackFilter.handleOAuth2Provider(OAuth2CallbackFilter.java:98)
> at org.sonar.server.authentication.OAuth2CallbackFilter.handleProvider(OAuth2CallbackFilter.java:77)
> at org.sonar.server.authentication.OAuth2CallbackFilter.doFilter(OAuth2CallbackFilter.java:70)
> at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139)
> at org.sonar.server.platform.web.MasterServletFilter.doFilter(MasterServletFilter.java:108)
> 
> ```

I seems problem with cert. But I can’t figure it out. Anyone can help?

---

<div class="post-metadata">

**Author:** ![hustlibraco](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/hustlibraco/32/14857_2.png) [@hustlibraco](https://community.sonarsource.com/u/hustlibraco)\
**Post date:** [April 13, 2020, 2:24pm UTC](https://community.sonarsource.com/t/delegate-authentication-to-gitlab-with-a-custom-ssl-certificate/23019/2 "2020-04-13T14:24:20Z")

</div>

This is my nginx conf for sonarqube. Does it right?

```
server {

    listen 80;

    return 301 https://$host$request_uri;

}

server {

    listen 443 ssl;

    ssl_certificate /etc/nginx/certs/server.crt;

    ssl_certificate_key /etc/nginx/certs/server.key;

    

    ssl_session_timeout 5m;

    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    ssl_prefer_server_ciphers on;

    location / {

        proxy_pass http://sonarqube:9000/;

        # proxy_redirect off;

        # proxy_set_header Host $host;

        # proxy_set_header X-Real-IP $remote_addr;

        # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto https;

    }

}
```

---

<div class="post-metadata">

**Author:** ![pierreguillot](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/pierreguillot/32/46022_2.png) [@pierreguillot](https://community.sonarsource.com/u/pierreguillot)\
**Post date:** [April 14, 2020, 8:24am UTC](https://community.sonarsource.com/t/delegate-authentication-to-gitlab-with-a-custom-ssl-certificate/23019/3 "2020-04-14T08:24:31Z")

</div>

Hi, welcome to the community!

Did you added the GitLab SSL certificate on the jre running SonarQube `truststore` ? What exact java version is SonarQube using ?

---

<div class="post-metadata">

**Author:** ![jgallucci32](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jgallucci32/32/19049_2.png) [@jgallucci32](https://community.sonarsource.com/u/jgallucci32)\
**Post date:** [February 8, 2021, 4:51am UTC](https://community.sonarsource.com/t/delegate-authentication-to-gitlab-with-a-custom-ssl-certificate/23019/4 "2021-02-08T04:51:28Z")

</div>

I ran into it and was able to resolve it after I better understood the requirements for using custom `cacerts` with the Oteemo Helm Chart. I had an entire bundle as a single file with all my certs. What ended up having to do was put all the certs into a directory and create the kubernetes secret based on the path, not the single file. After the redeploy it was able pickup the certs and get past this error message (GitLab fully integrated now too)