title: Gitlab ssl in subdomain validation failed
body: <p>I want to install gitlab in my nginx server. 
  I follow <a href="https://about.gitlab.com/install/" rel="nofollow noreferrer">this instruction</a> for the install.</p>
  
  <p><code>gitlab-ctl reconfigure</code> give me : </p>
  
  <pre><code>There was an error running gitlab-ctl reconfigure:
  
  letsencrypt_certificate[gitlab.domain.dev] (letsencrypt::http_authorization line 5) had an error: RuntimeError: acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 25) had an error: RuntimeError: ruby_block[create certificate for gitlab.domain.dev] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/resources/certificate.rb line 108) had an error: RuntimeError: [gitlab.domain.dev] Validation failed, unable to request certificate
  </code></pre>
  
  <p>I use : </p>
  
  <ul>
  <li>Debian 8</li>
  <li>Nginx</li>
  <li>My firewall allow 443 &amp; 80 (i have one site in http and one in https)</li>
  <li>I have access to sudo (or root)</li>
  <li><code>apt install ca-certificates curl openssh-server postfix</code></li>
  </ul>
  
  <p>I try : </p>
  
  <ul>
  <li>Create subdomaine <code>gitlab.domain.dev</code> in my dns</li>
  <li>Create SSL cert. for this domain with certbot</li>
  <li>At this step the subdomain is ok </li>
  <li>Install gitlab whit <code>EXTERNAL_URL="https://gitlab.domain.dev" apt-get install gitlab-ee</code></li>
  <li>At this step <code>gitlab.domain.dev</code> return nothing </li>
  <li>I test to edit the config file (<code>nano /etc/gitlab/gitlab.rb</code>) like this : </li>
  </ul>
  
  <pre><code>nginx['ssl_certificate'] = "/etc/letsencrypt/live/gitlab.domain.dev/fullchain.pem"
  nginx['ssl_certificate_key'] = "/etc/letsencrypt/live/gitlab.domain.dev/privkey.pem"
  </code></pre>
  
  <ul>
  <li>and run <code>gitlab-ctl reconfigure</code></li>
  <li>and catch the error</li>
  <li>i try <a href="https://stackoverflow.com/questions/51918116/gitlab-self-host-ssl-issues-validation-failed-for-domain">this</a> too</li>
  </ul>
  
  <p>I don't understand why i said to tell gitlab to use my ssl certificates already created and how to make my subdomain give gitlab.</p>
  
  <p>My nginx subdomain conf file : </p>
  
  <pre><code># the nginx server instance
  server {
  
      server_name gitlab.domain.dev;
      root /var/www/gitlab.domain.dev;
      index index.html index.htm index.nginx-debian.html;
  
      access_log /var/log/nginx/gitlab.domain.dev.log;
      location / {
              try_files $uri $uri/ =404;
      }
  
      listen [::]:443 ssl; # managed by Certbot
      listen 443 ssl; # managed by Certbot
      ssl_certificate /etc/letsencrypt/live/gitlab.domain.dev/fullchain.pem; # managed by Certbot
      ssl_certificate_key /etc/letsencrypt/live/gitlab.domain.dev/privkey.pem; # managed by Certbot
      include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
      ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
  
  }
  
  server {
      if ($host = gitlab.domain.dev) {
          return 301 https://$host$request_uri;
      } # managed by Certbot
  
  
      listen 80;
      listen [::]:80;
  
      server_name gitlab.domain.dev;
      return 404; # managed by Certbot
  
  
  }
  
  </code></pre>
  
  <h1>update 1</h1>
  
  <p>I try :</p>
  
  <ul>
  <li>convert <code>.pem</code> file to <code>.key</code> and <code>.crt</code> whit : </li>
  </ul>
  
  <pre><code>openssl x509 -outform der -in your-cert.pem -out your-cert.crt
  openssl pkey -in privkey.pem -out foo.key
  </code></pre>
  
  <ul>
  <li>change value of gitlab config file <code>nano /etc/gitlab/gitlab.rb</code>  to : </li>
  </ul>
  
  <pre><code>nginx['redirect_http_to_https'] = true
  nginx['ssl_certificate'] = "/etc/gitlab/ssl/gitlab.domain.dev.crt"
  nginx['ssl_certificate_key'] = "/etc/gitlab/ssl/gitlab.domain.dev.key"
  </code></pre>
  
  <ul>
  <li>reconfigure :</li>
  </ul>
  
  <pre><code>There was an error running gitlab-ctl reconfigure:
  
  letsencrypt_certificate[gitlab.domain.dev] (letsencrypt::http_authorization line 5) had an error: RuntimeError: acme_certificate[staging] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/letsencrypt/resources/certificate.rb line 25) had an error: RuntimeError: ruby_block[create certificate for gitlab.domain.dev] (/opt/gitlab/embedded/cookbooks/cache/cookbooks/acme/resources/certificate.rb line 108) had an error: RuntimeError: [gitlab.domain.dev] Validation failed, unable to request certificate
  
  </code></pre>