我的公司拥有https://data.ddl.at的证书，其中包括gitlab.ddl.at. 这个 Gitlab-Server 是内部的，域名只由我们内部的 DNS-Server 解析。作为参考，还有 SAN https://sicher.ddl.at，它是公开的，在浏览器中有效。
我已经在 Gitlab-Server 上配置了这个证书，当我去 时gitlab.ddl.at，证书被浏览器验证并被认为是有效的。
一旦我尝试使用 Gitlab-Runner，就会出现问题。我在另一台机器上安装并注册了一个，一开始遇到一些问题后，我让它连接到主实例，但作业仍然无法签出子模块，运行程序正在获取server certificate verification failed.
现在在这里我认为是问题的根本症状：如果我运行openssl s_client -connect data.ddl.at:443，我会得到：
CONNECTED(00000005)
depth=2 OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
verify return:1
depth=0 businessCategory = Private Organization, serialNumber = FN 374566h, jurisdictionC = AT, jurisdictionL = Wels, jurisdictionST = Oberoesterreich, C = AT, ST = Oberoesterreich, L = Ruestorf, street = Erwin Greiner-Str. 4, OU = GIS, O = DDL GmbH, CN = data.ddl.at
verify return:1
---
Certificate chain
0 s:businessCategory = Private Organization, serialNumber = FN 374566h, jurisdictionC = AT, jurisdictionL = Wels, jurisdictionST = Oberoesterreich, C = AT, ST = Oberoesterreich, L = Ruestorf, street = Erwin Greiner-Str. 4, OU = GIS, O = DDL GmbH, CN = data.ddl.at
i:C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
1 s:C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
i:OU = GlobalSign Root CA - R3, O = GlobalSign, CN = GlobalSign
---
Server certificate
[...]
最后：Verify return code: 0 (ok)
现在，当我运行时openssl s_client -connect gitlab.ddl.at:443，我得到：
CONNECTED(00000005)
depth=0 businessCategory = Private Organization, serialNumber = 374566h, jurisdictionC = AT, jurisdictionL = Wels, jurisdictionST = Oberoesterreich, C = AT, ST = Oberoesterreich, L = Ruestorf, street = Erwin Greiner-Stra\C3\9Fe 4, OU = GIS, O = DDL GmbH, CN = data.ddl.at
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 businessCategory = Private Organization, serialNumber = 374566h, jurisdictionC = AT, jurisdictionL = Wels, jurisdictionST = Oberoesterreich, C = AT, ST = Oberoesterreich, L = Ruestorf, street = Erwin Greiner-Stra\C3\9Fe 4, OU = GIS, O = DDL GmbH, CN = data.ddl.at
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:businessCategory = Private Organization, serialNumber = 374566h, jurisdictionC = AT, jurisdictionL = Wels, jurisdictionST = Oberoesterreich, C = AT, ST = Oberoesterreich, L = Ruestorf, street = Erwin Greiner-Stra\C3\9Fe 4, OU = GIS, O = DDL GmbH, CN = data.ddl.at
i:C = BE, O = GlobalSign nv-sa, CN = GlobalSign Extended Validation CA - SHA256 - G3
---
Server certificate
[...]
第一个错误是unable to get local issuer certificate.
我也尝试过使用可公开访问sicher.ddl.at的 ，但错误与gitlab.ddl.at.
它获得的证书是 for data.ddl.at，但它具有 SAN gitlab.ddl.at，这不应该使它有效吗？我究竟做错了什么？