cp -p *.crt /usr/local/share/ca-certificates/
update-ca-certificates

# curl -I https://arty.acme.local
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

# curl --cacert /usr/local/share/ca-certificates/acme-subca1.crt -I https://arty.acme.local
HTTP/1.1 200 OK
...

# wget https://arty.acme.local
--2026-06-11 11:41:00--  https://arty.acme.local/
Resolving arty.acme.local (arty.acme.local)... 10.245.208.69, 10.245.208.36
Connecting to arty.acme.local (arty.acme.local)|10.245.208.69|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 23381 (23K) [text/html]
Saving to: ‘index.html’

index.html                                           100%[====================================================================================================================>]  22.83K  --.-KB/s    in 0.02s

2026-06-11 11:41:00 (1.00 MB/s) - ‘index.html’ saved [23381/23381]

# which curl
/opt/gitlab/embedded/bin/curl

# cat /opt/gitlab/etc/gitaly/env/SSL_CERT_DIR  ; echo
/opt/gitlab/embedded/ssl/certs/

# cat /opt/gitlab/embedded/ssl/certs/README
This directory is managed by omnibus-gitlab.
 Any file placed in this directory will be ignored
. Place certificates in /etc/gitlab/trusted-certs.

# ls -l /etc/gitlab/trusted-certs
total 0

cp -p /usr/local/share/ca-certificates/* /etc/gitlab/trusted-certs/

Redémarrer Gitlab