Skip to content

TLS support

DETAILS: Tier: Free, Premium, Ultimate Offering: GitLab.com, Self-managed, GitLab Dedicated

GitLab prioritizes the security of data transmission between users and our platforms by employing Transport Layer Security (TLS) to safeguard information as it travels across the internet.

As cybersecurity threats continue to evolve, GitLab remains committed to maintaining the highest standards of security. We regularly update our TLS support to ensure that all communications with GitLab services are protected using the most secure and up-to-date encryption methods available.

This document outlines the current TLS support in GitLab, including the versions and cipher suites we use to keep your data safe and secure.

Supported protocols

GitLab supports TLS 1.2 and higher versions for secure communications. This means that TLS 1.2 and TLS 1.3 are fully supported and recommended for use with GitLab.

Older protocols such as TLS 1.1, TLS 1.0, and all versions of SSL are not supported due to known security vulnerabilities. By enforcing the use of TLS 1.2 and higher, GitLab ensures a high level of security for all data transmissions and interactions with the platform.

Supported cipher suites

GitLab supports the following cipher suites and protocol versions:

Protocol Version Cipher Suite Grade
TLSv1.3 TLS_AKE_WITH_AES_128_GCM_SHA256 A
TLSv1.3 TLS_AKE_WITH_AES_256_GCM_SHA384 A
TLSv1.3 TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 A
TLSv1.2 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 A
TLSv1.2 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 A
TLSv1.2 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256-draft A
TLSv1.2 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA A
TLSv1.2 TLS_RSA_WITH_AES_128_GCM_SHA256 A
TLSv1.2 TLS_RSA_WITH_AES_128_CBC_SHA A
TLSv1.2 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 A
TLSv1.2 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA A
TLSv1.2 TLS_RSA_WITH_AES_256_GCM_SHA384 A
TLSv1.2 TLS_RSA_WITH_AES_256_CBC_SHA A
TLSv1.2 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 A
TLSv1.2 TLS_RSA_WITH_AES_128_CBC_SHA256 A
TLSv1.2 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 A
TLSv1.2 TLS_RSA_WITH_AES_256_CBC_SHA256 A

Certificate requirements

OpenSSL 3 increased the default security level from level 1 to 2, raising the number of bits of security from 80 to 112. As a result, RSA, DSA, and DH keys shorter than 2048 bits and ECC keys shorter than 224 bits are prohibited. GitLab will fail to connect to a service that uses a certificate signed with insufficient bits with a certificate key too weak error message.

We strongly recommend using at least 128 bits of security. This means using RSA, DSA, and DH keys with at least 3072 bits, and ECC keys longer than 256 bits.

Key type Key length (bits) Status
RSA 1024 Prohibited
RSA 2048 Supported
RSA 3072 Recommended
RSA 4096 Recommended
DSA 1024 Prohibited
DSA 2048 Supported
DSA 3072 Recommended
ECC 192 Prohibited
ECC 224 Supported
ECC 256 Recommended
ECC 384 Recommended

OpenSSL version and TLS requirements

GitLab 17.7 and later use OpenSSL version 3. All components that are shipped with the Linux package are compatible with OpenSSL 3. However, before upgrading to GitLab 17.7, use the OpenSSL 3 guide to identify and assess the compatibility of your external integrations.