{
  "id": "nginx/proxy-pass-https-backend-certificate-verify-failed",
  "signature": "upstream SSL certificate verify failed: self-signed certificate in certificate chain",
  "signature_zh": "上游 SSL 证书验证失败：证书链中存在自签名证书",
  "regex": "upstream SSL certificate verify failed: self-signed certificate in certificate chain",
  "domain": "nginx",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "Nginx's proxy_pass to an HTTPS upstream fails because the upstream's SSL certificate is self-signed or signed by an untrusted CA, and nginx's default SSL verification rejects it.",
  "root_cause_type": "generic",
  "root_cause_zh": "Nginx 向 HTTPS 上游的 proxy_pass 失败，因为上游的 SSL 证书是自签名或由不受信任的 CA 签发，而 nginx 的默认 SSL 验证拒绝了它。",
  "versions": [
    {
      "version": "nginx 1.20.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "nginx 1.22.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "nginx 1.24.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "While it bypasses the error, it exposes the connection to man-in-the-middle attacks.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Nginx uses its own CA bundle specified by proxy_ssl_trusted_certificate, not the system store by default.",
      "fail_rate": 0.75,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "The certificate itself is unchanged; nginx still rejects it.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Configure nginx to trust the upstream's self-signed certificate by specifying the CA file in proxy_ssl_trusted_certificate. Example:\nlocation / {\n    proxy_pass https://upstream.example.com;\n    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;\n    proxy_ssl_verify on;\n    proxy_ssl_verify_depth 2;\n}",
      "success_rate": 0.95,
      "how": "Configure nginx to trust the upstream's self-signed certificate by specifying the CA file in proxy_ssl_trusted_certificate. Example:\nlocation / {\n    proxy_pass https://upstream.example.com;\n    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;\n    proxy_ssl_verify on;\n    proxy_ssl_verify_depth 2;\n}",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use proxy_ssl_verify off only in development environments with a clear comment that it is insecure.",
      "success_rate": 0.85,
      "how": "Use proxy_ssl_verify off only in development environments with a clear comment that it is insecure.",
      "condition": "",
      "sources": []
    },
    {
      "action": "If the upstream uses a corporate CA, download the CA certificate and place it in /etc/nginx/ssl/, then reference it as above.",
      "success_rate": 0.9,
      "how": "If the upstream uses a corporate CA, download the CA certificate and place it in /etc/nginx/ssl/, then reference it as above.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Configure nginx to trust the upstream's self-signed certificate by specifying the CA file in proxy_ssl_trusted_certificate. Example:\nlocation / {\n    proxy_pass https://upstream.example.com;\n    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;\n    proxy_ssl_verify on;\n    proxy_ssl_verify_depth 2;\n}",
    "Use proxy_ssl_verify off only in development environments with a clear comment that it is insecure.",
    "If the upstream uses a corporate CA, download the CA certificate and place it in /etc/nginx/ssl/, then reference it as above."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_trusted_certificate",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.87,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2023-07-10",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}