nginx auth_error ai_generated true

SSL：证书验证失败：证书链中存在自签名证书，在与上游进行 SSL 握手时

SSL: certificate verify failed: self-signed certificate in certificate chain while SSL handshaking to upstream

ID: nginx/ssl-certificate-verify-failed-self-signed-certificate-in-chain

其他格式: JSON · Markdown 中文 · English
80%修复率
86%置信度
1证据数
2023-09-20首次发现

版本兼容性

版本状态引入弃用备注
nginx 1.18.0 active — — —
nginx 1.20.1 active — — —
nginx 1.22.0 active — — —
nginx 1.24.0 active — — —

根因分析

上游服务器使用了自签名证书或链以自签名根证书结尾，并且 nginx 启用了 proxy_ssl_verify 但未配置正确的 CA 证书。

English

Upstream server uses a self-signed certificate or a chain ending in a self-signed root, and nginx proxy_ssl_verify is enabled without the proper CA certificate.

generic

官方文档

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify

解决方案

  1. Obtain the upstream's self-signed CA certificate and configure proxy_ssl_trusted_certificate with that CA file, then enable proxy_ssl_verify. Example:
proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
  2. Replace the upstream's self-signed certificate with one signed by a public CA (e.g., Let's Encrypt). This eliminates the need for custom trust configuration.

无效尝试

常见但无效的做法:

  1. Set proxy_ssl_verify off; 50% 失败

    Disabling verification entirely bypasses security; it works but is not recommended for production with sensitive data.

  2. Use proxy_ssl_trusted_certificate with the upstream's public certificate only 70% 失败

    If the upstream has a full chain, nginx needs the root CA, not just the leaf cert. The leaf cert alone may not establish trust.

  3. Regenerate upstream certificate with same CA 80% 失败

    If the CA itself is self-signed and not trusted, regenerating the leaf cert won't fix the trust chain.