您的位置:首页 > 理论基础 > 计算机网络

Chrome以https访问gitlab的问题:Your connection is not private

2015-12-14 20:43 671 查看
在Chrome中以https访问自己搭建的gitlab站点时经常出现下面的错误:


Attackers might be trying to steal your information from xxx.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID

xxx.com normally uses encryption to protect your information. When Chrome tried to connect to xxx.com this time, the website sent back unusual and incorrect credentials. Either an attacker is trying to pretend to be xxx.com, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Chrome stopped the connection before any data was exchanged.

You cannot visit xxx.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later.


出现这个问题时,无法正常访问gitlab站点,只能换Firefox访问。

这个问题是两方面的原因引起的:

1)Chrome检查证书权威失败(用的是GoDaddy证书,可能是GoDaddy证书本身的问题);

2)gitlab在http response headers中强制添加了下面的内容:

Strict-Transport-Security: max-age=31536000

这个响应头会造成Chrome在检查证书失败后不允许继续访问。

临时解决方法
修改gitlatb的代码,用vim打开下面的文件

vi /opt/gitlab/embedded/service/gitlab-rails/app/controllers/application_controller.rb

注释掉下面的代码:

# if Gitlab.config.gitlab.https and Gitlab.config.gitlab.port == 443
# headers['Strict-Transport-Security'] = 'max-age=31536000'
# end

然后重启gitlab服务

gitlab-ctl restart

参考资料

Rails, Secure Cookies, HSTS and friends

Adding HSTS header breaks HSTS if apache/nginx globally adds a header
内容来自用户分享和网络整理,不保证内容的准确性,如有侵权内容,可联系管理员处理 点击这里给我发消息
标签: