# 上游 SSL 证书验证失败：证书链中存在自签名证书

- **ID:** `nginx/proxy-pass-https-backend-certificate-verify-failed`
- **领域:** nginx
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

Nginx 向 HTTPS 上游的 proxy_pass 失败，因为上游的 SSL 证书是自签名或由不受信任的 CA 签发，而 nginx 的默认 SSL 验证拒绝了它。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| nginx 1.20.x | active | — | — |
| nginx 1.22.x | active | — | — |
| nginx 1.24.x | active | — | — |

## 解决方案

1. ```
   Configure nginx to trust the upstream's self-signed certificate by specifying the CA file in proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream.example.com;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}
   ```
2. ```
   Use proxy_ssl_verify off only in development environments with a clear comment that it is insecure.
   ```
3. ```
   If the upstream uses a corporate CA, download the CA certificate and place it in /etc/nginx/ssl/, then reference it as above.
   ```

## 无效尝试

- **** — While it bypasses the error, it exposes the connection to man-in-the-middle attacks. (95% 失败率)
- **** — Nginx uses its own CA bundle specified by proxy_ssl_trusted_certificate, not the system store by default. (75% 失败率)
- **** — The certificate itself is unchanged; nginx still rejects it. (90% 失败率)