nginx auth_error ai_generated true

上游 SSL 证书验证失败：证书链中存在自签名证书

upstream SSL certificate verify failed: self-signed certificate in certificate chain

ID: nginx/proxy-pass-https-backend-certificate-verify-failed

其他格式: JSON · Markdown 中文 · English
90%修复率
87%置信度
1证据数
2023-07-10首次发现

版本兼容性

版本状态引入弃用备注
nginx 1.20.x active — — —
nginx 1.22.x active — — —
nginx 1.24.x active — — —

根因分析

Nginx 向 HTTPS 上游的 proxy_pass 失败，因为上游的 SSL 证书是自签名或由不受信任的 CA 签发，而 nginx 的默认 SSL 验证拒绝了它。

English

Nginx's proxy_pass to an HTTPS upstream fails because the upstream's SSL certificate is self-signed or signed by an untrusted CA, and nginx's default SSL verification rejects it.

generic

官方文档

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_trusted_certificate

解决方案

  1. Configure nginx to trust the upstream's self-signed certificate by specifying the CA file in proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream.example.com;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}
  2. Use proxy_ssl_verify off only in development environments with a clear comment that it is insecure.
  3. If the upstream uses a corporate CA, download the CA certificate and place it in /etc/nginx/ssl/, then reference it as above.

无效尝试

常见但无效的做法:

  1. 95% 失败

    While it bypasses the error, it exposes the connection to man-in-the-middle attacks.

  2. 75% 失败

    Nginx uses its own CA bundle specified by proxy_ssl_trusted_certificate, not the system store by default.

  3. 90% 失败

    The certificate itself is unchanged; nginx still rejects it.