The "ca.crt" in my guide is part of the signing chain. You renamed your "nginx-selfsigned-gitlab.crt" to "ca.crt"? If that's the case I think this is the 'intermediate' chain cert you need to cp to your gitlab runner. The part "cp ca.crt /srv/gitlab-runner/ssl/" in my guide.