nginx auth_error ai_generated true

upstream SSL certificate verify failed: self-signed certificate in certificate chain

ID: nginx/proxy-pass-https-backend-certificate-verify-failed

Also available as: JSON · Markdown · 中文

90%Fix Rate

87%Confidence

1Evidence

2023-07-10First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
nginx 1.20.x	active	—	—	—
nginx 1.22.x	active	—	—	—
nginx 1.24.x	active	—	—	—

Root Cause

Nginx's proxy_pass to an HTTPS upstream fails because the upstream's SSL certificate is self-signed or signed by an untrusted CA, and nginx's default SSL verification rejects it.

generic

中文

Nginx 向 HTTPS 上游的 proxy_pass 失败，因为上游的 SSL 证书是自签名或由不受信任的 CA 签发，而 nginx 的默认 SSL 验证拒绝了它。

Official Documentation

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_trusted_certificate

Workarounds

95% success Configure nginx to trust the upstream's self-signed certificate by specifying the CA file in proxy_ssl_trusted_certificate. Example: location / { proxy_pass https://upstream.example.com; proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt; proxy_ssl_verify on; proxy_ssl_verify_depth 2; }
```
Configure nginx to trust the upstream's self-signed certificate by specifying the CA file in proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream.example.com;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}
```
85% success Use proxy_ssl_verify off only in development environments with a clear comment that it is insecure.
```
Use proxy_ssl_verify off only in development environments with a clear comment that it is insecure.
```
90% success If the upstream uses a corporate CA, download the CA certificate and place it in /etc/nginx/ssl/, then reference it as above.
```
If the upstream uses a corporate CA, download the CA certificate and place it in /etc/nginx/ssl/, then reference it as above.
```

中文步骤

Configure nginx to trust the upstream's self-signed certificate by specifying the CA file in proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream.example.com;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}

Use proxy_ssl_verify off only in development environments with a clear comment that it is insecure.

If the upstream uses a corporate CA, download the CA certificate and place it in /etc/nginx/ssl/, then reference it as above.

Dead Ends

Common approaches that don't work:

95% fail
While it bypasses the error, it exposes the connection to man-in-the-middle attacks.
75% fail
Nginx uses its own CA bundle specified by proxy_ssl_trusted_certificate, not the system store by default.
90% fail
The certificate itself is unchanged; nginx still rejects it.