# SSL: certificate verify failed: self-signed certificate in certificate chain

- **ID:** `nginx/ssl-certificate-verify-failed-self-signed`
- **Domain:** nginx
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

The upstream server's SSL certificate is self-signed or its CA is not trusted by nginx's default CA bundle, causing the handshake to fail.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| nginx-1.24.0 | active | — | — |
| nginx-1.25.3 | active | — | — |
| nginx-1.26.0 | active | — | — |

## Workarounds

1. **Add the self-signed certificate to nginx's trusted CA file and set proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}** (90% success)
   ```
   Add the self-signed certificate to nginx's trusted CA file and set proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}
   ```
2. **If the upstream is internal and security is not critical, temporarily disable verification for testing: proxy_ssl_verify off; (not recommended for production).** (80% success)
   ```
   If the upstream is internal and security is not critical, temporarily disable verification for testing: proxy_ssl_verify off; (not recommended for production).
   ```

## Dead Ends

- **** — It bypasses security, leaving the connection vulnerable to MITM attacks. (70% fail)
- **** — This directive controls client certificate verification, not upstream verification. (90% fail)
- **** — Nginx may not automatically pick up system CA changes unless the bundle path is explicitly set. (50% fail)