nginx auth_error ai_generated true

SSL: certificate verify failed: self-signed certificate in certificate chain

ID: nginx/ssl-certificate-verify-failed-self-signed

Also available as: JSON · Markdown · 中文
85%Fix Rate
88%Confidence
1Evidence
2023-11-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
nginx-1.24.0 active — — —
nginx-1.25.3 active — — —
nginx-1.26.0 active — — —

Root Cause

The upstream server's SSL certificate is self-signed or its CA is not trusted by nginx's default CA bundle, causing the handshake to fail.

generic

中文

上游服务器的 SSL 证书是自签名的或其 CA 未被 nginx 的默认 CA 包信任，导致握手失败。

Official Documentation

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify

Workarounds

  1. 90% success Add the self-signed certificate to nginx's trusted CA file and set proxy_ssl_trusted_certificate. Example: location / { proxy_pass https://upstream; proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt; proxy_ssl_verify on; proxy_ssl_verify_depth 2; } 
    Add the self-signed certificate to nginx's trusted CA file and set proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}
  2. 80% success If the upstream is internal and security is not critical, temporarily disable verification for testing: proxy_ssl_verify off; (not recommended for production). 
    If the upstream is internal and security is not critical, temporarily disable verification for testing: proxy_ssl_verify off; (not recommended for production).

中文步骤

  1. Add the self-signed certificate to nginx's trusted CA file and set proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}
  2. If the upstream is internal and security is not critical, temporarily disable verification for testing: proxy_ssl_verify off; (not recommended for production).

Dead Ends

Common approaches that don't work:

  1. 70% fail

    It bypasses security, leaving the connection vulnerable to MITM attacks.

  2. 90% fail

    This directive controls client certificate verification, not upstream verification.

  3. 50% fail

    Nginx may not automatically pick up system CA changes unless the bundle path is explicitly set.