# SSL：证书验证失败：证书链中存在自签名证书，在与上游进行 SSL 握手时

- **ID:** `nginx/ssl-certificate-verify-failed-self-signed-certificate-in-chain`
- **领域:** nginx
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

上游服务器使用了自签名证书或链以自签名根证书结尾，并且 nginx 启用了 proxy_ssl_verify 但未配置正确的 CA 证书。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| nginx 1.18.0 | active | — | — |
| nginx 1.20.1 | active | — | — |
| nginx 1.22.0 | active | — | — |
| nginx 1.24.0 | active | — | — |

## 解决方案

1. ```
   Obtain the upstream's self-signed CA certificate and configure proxy_ssl_trusted_certificate with that CA file, then enable proxy_ssl_verify. Example:
proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
   ```
2. ```
   Replace the upstream's self-signed certificate with one signed by a public CA (e.g., Let's Encrypt). This eliminates the need for custom trust configuration.
   ```

## 无效尝试

- **Set proxy_ssl_verify off;** — Disabling verification entirely bypasses security; it works but is not recommended for production with sensitive data. (50% 失败率)
- **Use proxy_ssl_trusted_certificate with the upstream's public certificate only** — If the upstream has a full chain, nginx needs the root CA, not just the leaf cert. The leaf cert alone may not establish trust. (70% 失败率)
- **Regenerate upstream certificate with same CA** — If the CA itself is self-signed and not trusted, regenerating the leaf cert won't fix the trust chain. (80% 失败率)