GitLab OmniAuth plugin

I have the plugin set up, and I’m getting the popup. It begins to authenticate, and if you are already logged in with Gitlab you get an Auth or Deny choice. If I select Authorize, the browser says the site is unable to handle the request. And the Discourse error log shows:

Faraday::SSLError (SSL_connect returned=1 errno=0 state=error: certificate verify failed)
/usr/local/lib/ruby/2.3.0/net/http.rb:933:in `connect_nonblock’

Both my Gitlab site and my Discourse site have Treasury dept signed SSL certs.