How to use HTTPS on windows server? #6881

New Issue

GiteaMirror · 2025-11-02T07:09:50-06:00

GiteaMirror commented

2025-11-02 07:09:50 -06:00

Originally created by @harkirat777 on GitHub (Feb 17, 2021).

Gitea version (or commit ref): 1.13.0
Operating system: Microsoft Server 2012 R2

Description

We are running Gitea as windows service. I have followed the instructions in docs for HTTPS setup Using the built-in server. But, https://[HOST]:3000/ gives certificate error on the server and the clients.
Log file has following error:
...c/net/http/server.go:3095:logf() [I] http: TLS handshake error from 10.X.X.X:63846: remote error: tls: unknown certificate

Is there another step we are missing?

Originally created by @harkirat777 on GitHub (Feb 17, 2021).   - Gitea version (or commit ref): 1.13.0 - Operating system: Microsoft Server 2012 R2 ## Description We are running Gitea as windows service. I have followed the instructions [in docs for HTTPS setup Using the built-in server](https://docs.gitea.io/en-us/https-setup/#using-the-built-in-server). But, https://[HOST]:3000/ gives certificate error on the server and the clients. Log file has following error: `...c/net/http/server.go:3095:logf() [I] http: TLS handshake error from 10.X.X.X:63846: remote error: tls: unknown certificate` Is there another step we are missing?

GiteaMirror added the type/question issue/needs-feedback labels 2025-11-02 07:09:50 -06:00

GiteaMirror closed this issue

2025-11-02 07:09:50 -06:00

GiteaMirror commented

2025-11-02 07:09:50 -06:00

@techknowlogick commented on GitHub (Feb 17, 2021):

TLS handshake error from 10.X.X.X:63846: remote error: tls: unknown certificate means that the client is offering up a certificate.

What error do browsers give when accessing your install? On your browser it'll say something like the error is due to the cert being expired, the authority is not known to your device, the cert has been revoke, or one of many more possible errors.

@techknowlogick commented on GitHub (Feb 17, 2021): `TLS handshake error from 10.X.X.X:63846: remote error: tls: unknown certificate` means that the client is offering up a certificate. What error do browsers give when accessing your install? On your browser it'll say something like the error is due to the cert being expired, the authority is not known to your device, the cert has been revoke, or one of many more possible errors.

GiteaMirror commented

2025-11-02 07:09:51 -06:00

@harkirat777 commented on GitHub (Feb 18, 2021):

We are getting NET::ERR_CERT_AUTHORITY_INVALID.
This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.

How can I push this certificate to all the clients? Is there a way to accomplish this without Group Policy?

@harkirat777 commented on GitHub (Feb 18, 2021): We are getting NET::ERR_CERT_AUTHORITY_INVALID. `This CA Root certificate is not trusted because it is not in the Trusted Root Certification Authorities store.` How can I push this certificate to all the clients? Is there a way to accomplish this without Group Policy?

GiteaMirror commented

2025-11-02 07:09:51 -06:00

@techknowlogick commented on GitHub (Feb 18, 2021):

You either need to use a certificate that has an authority already trusted by the remote machines, or you need to push the authority to the machines. You can have people manually install the authority on their machines, but I strongly recommend using an authority that is already trusted. You could use caddyserver in front of Gitea and use their Letsencrypt DNS implementation if this instance is not available to the internet.

However Gitea is serving the certificate you provided correctly, as such I will be closing this.

@techknowlogick commented on GitHub (Feb 18, 2021): You either need to use a certificate that has an authority already trusted by the remote machines, or you need to push the authority to the machines. You can have people manually install the authority on their machines, but I strongly recommend using an authority that is already trusted. You could use caddyserver in front of Gitea and use their Letsencrypt DNS implementation if this instance is not available to the internet. However Gitea is serving the certificate you provided correctly, as such I will be closing this.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6881