title: How to make GitLab Runner in Docker see a custom CA Root certificate
body: <p>I have installed and configured: </p>
  
  <ol>
  <li>an on-premises <strong>GitLab Omnibus</strong> on <strong>ServerA</strong> running on HTTPS</li>
  <li>an on-premises <strong>GitLab-Runner</strong> installed as Docker Service in <strong>ServerB</strong></li>
  </ol>
  
  <p><strong>ServerA certificate is generated by a custom CA Root</strong></p>
  
  <h2>The Configuration</h2>
  
  <p>I've have put the CA Root Certificate on ServerB:</p>
  
  <pre class="lang-sh prettyprint-override"><code>/srv/gitlab-runner/config/certs/ca.crt
  </code></pre>
  
  <p>Installed the Runner on <strong>ServerB</strong> as described in <a href="https://docs.gitlab.com/runner/install/docker.html#docker-image-installation-and-configuration" rel="noreferrer"><strong>Run GitLab Runner in a container</strong> - Docker image installation and configuration</a>:</p>
  
  <pre class="lang-sh prettyprint-override"><code>docker run -d --name gitlab-runner --restart always \
             -v /srv/gitlab-runner/config:/etc/gitlab-runner \
             -v /var/run/docker.sock:/var/run/docker.sock \
             gitlab/gitlab-runner:latest
  </code></pre>
  
  <p>Registered the Runner as described in <a href="https://docs.gitlab.com/runner/register/index.html#one-line-registration-command" rel="noreferrer"><strong>Registering Runners</strong> - One-line registration command</a>:</p>
  
  <pre class="lang-sh prettyprint-override"><code>docker run --rm -t -i 
              -v /srv/gitlab-runner/config:/etc/gitlab-runner 
             --name gitlab-docker-runner gitlab/gitlab-runner register \
             --non-interactive \
             --executor "docker" \
             --docker-image alpine:latest \
             --url "https://MY_PRIVATE_REPO_URL_HERE/" \
             --registration-token "MY_PRIVATE_TOKEN_HERE" \
             --description "MyDockerServer-Runner" \
             --tag-list "TAG_1,TAG_2,TAG_3" \
             --run-untagged \
             --locked="false"
  </code></pre>
  
  <p>This command gave the following output:</p>
  
  <blockquote>
    <p><strong>Updating CA certificates...</strong>
    <br>Runtime platform                                    arch=amd64 os=linux pid=5 revision=cf91d5e1 version=11.4.2
    <br>Running in system-mode.</p>
    
    <p>Registering runner... succeeded                     runner=8UtcUXCY
    <br>Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded!</p>
  </blockquote>
  
  <p>I checked with</p>
  
  <pre class="lang-sh prettyprint-override"><code>$ docker exec -it gitlab-runner bash 
  </code></pre>
  
  <p>and once in the container with</p>
  
  <pre class="lang-sh prettyprint-override"><code>$ awk -v cmd='openssl x509 -noout -subject' '
  /BEGIN/{close(cmd)};{print | cmd}' &lt; /etc/ssl/certs/ca-certificates.crt
  </code></pre>
  
  <p>and <strong>the custom CA root is correctly there</strong>.</p>
  
  <h2>The Problem</h2>
  
  <p>When running Gitlab-Runner from GitLab-CI, the pipeline fails miserably telling me that:</p>
  
  <blockquote>
    <p>$ <strong>git clone https://gitlab-ci-token:${CI_BUILD_TOKEN}@ServerA/foo/bar/My-Project.wiki.git</strong></p>
    
    <p><br>    Cloning into 'My-Project.wiki'...</p>
    
    <p><br>    fatal: unable to access '<a href="https://gitlab-ci-token:xxxxxxxxxxxxxxxxxxxx@ServerA/foo/bar/My-Project.wiki.git/" rel="noreferrer">https://gitlab-ci-token:xxxxxxxxxxxxxxxxxxxx@ServerA/foo/bar/My-Project.wiki.git/</a>': <strong>server certificate verification failed. CAfile: /etc/ssl/certs/ca-certificates.crt</strong> CRLfile: none</p>
    
    <p><br>   ERROR: Job failed: exit code 1</p>
  </blockquote>
  
  <p>It does not recognize the Issuer (my custom CA Root), but according to <a href="https://docs.gitlab.com/runner/configuration/tls-self-signed.html" rel="noreferrer"><strong>The self-signed certificates or custom Certification Authorities</strong></a>, point n.1, it should out-of-the-box:</p>
  
  <blockquote>
    <p>Default: <strong>GitLab Runner reads system certificate store and verifies the GitLab server against the CA’s stored in system</strong>.</p>
  </blockquote>
  
  <p>I've then tried the solution from point n.3, editing </p>
  
  <pre class="lang-sh prettyprint-override"><code>/srv/gitlab-runner/config/config.toml:
  </code></pre>
  
  <p>and adding: </p>
  
  <pre class="lang-sh prettyprint-override"><code>[[runners]]
  tls-ca-file = "/srv/gitlab-runner/config/certs/ca.crt"
  </code></pre>
  
  <p>But it still doesn't work.</p>
  
  <p><strong>How can I make Gitlab Runner read the CA Root certificate?</strong></p>