nginx auth_error ai_generated true

SSL 证书验证失败：证书链中包含自签名证书

SSL: certificate verify failed: self-signed certificate in certificate chain

ID: nginx/ssl-certificate-verify-failed-self-signed

其他格式: JSON · Markdown 中文 · English
85%修复率
88%置信度
1证据数
2023-11-20首次发现

版本兼容性

版本状态引入弃用备注
nginx-1.24.0 active — — —
nginx-1.25.3 active — — —
nginx-1.26.0 active — — —

根因分析

上游服务器的 SSL 证书是自签名的或其 CA 未被 nginx 的默认 CA 包信任，导致握手失败。

English

The upstream server's SSL certificate is self-signed or its CA is not trusted by nginx's default CA bundle, causing the handshake to fail.

generic

官方文档

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_verify

解决方案

  1. Add the self-signed certificate to nginx's trusted CA file and set proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}
  2. If the upstream is internal and security is not critical, temporarily disable verification for testing: proxy_ssl_verify off; (not recommended for production).

无效尝试

常见但无效的做法:

  1. 70% 失败

    It bypasses security, leaving the connection vulnerable to MITM attacks.

  2. 90% 失败

    This directive controls client certificate verification, not upstream verification.

  3. 50% 失败

    Nginx may not automatically pick up system CA changes unless the bundle path is explicitly set.