<p>I am attempting to install gitlab using helm. I have a certificate issued to me by the internal Certificate Authority and I have used the <code>.pem</code> and <code>.key</code> file to generate a tls secrete with this command:</p>
<pre><code>kubectl create secret tls gitlab-cert --cert=&lt;cert&gt;.pem --key=&lt;cert&gt;.key
</code></pre>
<p>When I run the helm installation, I am expecting to be able to view gitlab with <code>https://{internal-domain}</code>, however I get the below image.</p>
<p><a href="https://i.stack.imgur.com/CoYaG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/CoYaG.png" alt="enter image description here" /></a></p>
<p><strong>HELM installtion configuration</strong></p>
<pre><code>helm install gitlab gitlab/gitlab \
  --timeout 600s \
  --set global.hosts.domain=${hosts_domain} \
  --namespace ${helm_namespace} \
  --set global.hosts.externalIP=${static_ip} \
  --set postgresql.install=false \
  --set global.psql.host=${postgres_sql_ip} \
  --set global.psql.password.secret=${k8s_password_secret} \
  --set global.psql.username=${postgres_sql_user} \
  --set global.psql.password.key=${k8s_password_key}
  --set global.psql.ssl.secret=${psql_ssl_secret} \
  --set global.psql.ssl.clientCertificate=${psql_ssl_client_certificate} \
  --set global.psql.ssl.clientKey=${psql_ssl_client_key} \
  --set global.psql.ssl.serverCA=${psql_ssl_server_ca} \
  --set global.extraEnv.PGSSLCERT=${extra_env_pg_ssl_cert} \
  --set global.extraEnv.PGSSLKEY=${extra_env_pg_ssl_key} \
  --set global.extraEnv.PGSSLROOTCERT=${extra_env_pg_ssl_root_cert} \
  --set global.host.https=true \
  --set global.ingress.tls.enabled=true \
  --set global.ingress.tls.secretName=${gitlab-cert} \
  --set certmanager.install=false \
  --set global.ingress.configureCertmanager=false \
  --set gitlab.webservice.ingress.tls.secretName=${gitlab-cert}
</code></pre>
<p>The pods run fine.</p>

floormind
<p>Posted community wiki answer for better visibility. Feel free to expand it.</p>
<hr />
<p>Based on @sytech comment:</p>
<blockquote>
<p>The error you have there is <code>CERT_WEAK_SIGNATURE_ALGORITHM</code>. It seems you should probably regenerate your certificate using a stronger algorithm.</p>
</blockquote>
<p>You are probably using some weak signature algorithm. Both <a href="https://www.chromium.org/Home/chromium-security/education/tls#TOC-Deprecated-and-Removed-Features" rel="nofollow noreferrer">Chrome</a> and <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Weak_Signature_Algorithm" rel="nofollow noreferrer">Mozilla Firefox</a>  are not <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Weak_Signature_Algorithm" rel="nofollow noreferrer">treating certificates based on weak algorithms as secure</a>:</p>
<blockquote>
<p>SHA-1 certificates will no longer be treated as secure by major browser manufacturers beginning in 2017.</p>
</blockquote>
<blockquote>
<p>Support for MD5 based signatures was removed in early 2012.</p>
</blockquote>
<p>Please make sure that you are <a href="https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/" rel="nofollow noreferrer">using more secure algorithm</a>:</p>
<blockquote>
<p>We encourage Certification Authorities (CAs) and Web site administrators to upgrade their certificates to use signature algorithms with hash functions that are stronger than SHA-1, such as SHA-256, SHA-384, or SHA-512.</p>
</blockquote>
<p>Another option is that it may be issue at your end - check your network and browser settings - <a href="https://www.auslogics.com/en/articles/fix-neterr-cert-weak-signature-algorithm-error/" rel="nofollow noreferrer">steps are presented in this article</a>.</p>
