# SSL 证书验证失败：证书链中包含自签名证书

- **ID:** `nginx/ssl-certificate-verify-failed-self-signed`
- **领域:** nginx
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 85%

## 根因

上游服务器的 SSL 证书是自签名的或其 CA 未被 nginx 的默认 CA 包信任，导致握手失败。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| nginx-1.24.0 | active | — | — |
| nginx-1.25.3 | active | — | — |
| nginx-1.26.0 | active | — | — |

## 解决方案

1. ```
   Add the self-signed certificate to nginx's trusted CA file and set proxy_ssl_trusted_certificate. Example:
location / {
    proxy_pass https://upstream;
    proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 2;
}
   ```
2. ```
   If the upstream is internal and security is not critical, temporarily disable verification for testing: proxy_ssl_verify off; (not recommended for production).
   ```

## 无效尝试

- **** — It bypasses security, leaving the connection vulnerable to MITM attacks. (70% 失败率)
- **** — This directive controls client certificate verification, not upstream verification. (90% 失败率)
- **** — Nginx may not automatically pick up system CA changes unless the bundle path is explicitly set. (50% 失败率)