Gitlab HTTPS URI for repository cloning does not work - SSL host could not be verified - fatal: unable to access

Question

When I make Eclipse -> File -> Import -> Projects -> Projects from Git -> Clone URI -> enter repository HTTPS URI from Gitlab, I get error:

Possible reasons:
Incorrect URL
No network connection (e.g. wrong proxy settings)
SSL host could not be verified (set http.sslVerify=false in Git configuration)

I have added http.sslVerify false in Eclipse configuration but it still does not work.

If I make git clone https://my.example.com/gitlab/root/repository.git in cmd, I get:

Cloning into 'repository'...
fatal: unable to access 'https://my.example.com/gitlab/root/repository.git': The requested URL returned error: 500

Gitlab production logs show:

Processing by Projects::GitHttpController#info_refs as HTML
Parameters: {"service"=>"git-upload-pack", "namespace_id"=>"java", "project_id"=>"project.git"}
Completed 500 Internal Server Error in 102ms (ActiveRecord: 2.5ms)
JWT::DecodeError (Nil JSON web token):
lib/gitlab/workhorse.rb:120:in 'verify_api_request!'
app/controllers/projects/git_http_client_controller.rb:154:in 'verify_workhorse_api!'
lib/gitlab/request_profiler/middleware.rb:15:in 'call'
lib/gitlab/middleware/go.rb:16:in `call'

SSH URL works well. Gitlab is used with Apache2 and HTTPS. /etc/gitlab/gitlab.rb contains:

external_url 'https://my.example.com/gitlab'
web_server['username'] = 'apache' #'gitlab-www'
web_server['group'] = 'apache' #'gitlab-www'
nginx['enable'] = false
unicorn['listen'] = '127.0.0.1'
unicorn['port'] = 9099

/etc/apache2/apache2.conf contains:

ProxyPass /gitlab http://127.0.0.1:9099/gitlab
ProxyPassReverse /gitlab http://127.0.0.1:9099/gitlab
RequestHeader add X-Forwarded-Proto https

Used versions:

GitLab 8.14.5
GitLab Shell 4.0.3
GitLab Workhorse 1.1.1
GitLab API v3
Git 2.7.4

There is article about similar problem Fixing issues with cloning via HTTPS on GitLab but modifying /etc/gitlab/gitlab.rb gitlab-workhorse configuration didn't help.

Similar problems: Error 500 on git operation using HTTP(S) with Apache as Reverse Proxy

How to solve this problem?

Answer 1

Enabled gitlab-workhorse on 9191 port:

external_url 'https://my.example.com/gitlab'

gitlab_workhorse['enable'] = true
gitlab_workhorse['listen_network'] = "tcp"
gitlab_workhorse['listen_addr'] = "127.0.0.1:9191"

unicorn['listen'] = '127.0.0.1'
unicorn['port'] = 9099

web_server['external_users'] = ['www-data']
web_server['username'] = 'apache' #'gitlab-www'
web_server['group'] = 'apache' #'gitlab-www'

nginx['enable'] = false

That's the whole gitlab.rb configuration, other lines are commented.

And made proxyPass in /etc/apache2/apache2.conf to the gitlab-workhorse working on 9191 port instead of Unicorn:

ProxyPass /gitlab http://127.0.0.1:9191/gitlab
RequestHeader add X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Ssl on