nginx auth_error ai_generated true

SSL certificate verify failed while SSL handshaking to upstream

ID: nginx/ssl-certificate-verify-failed-upstream

Also available as: JSON · Markdown · 中文
85%Fix Rate
87%Confidence
1Evidence
2023-09-05First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
nginx 1.18.0 active — — —
nginx 1.20.2 active — — —
nginx 1.22.1 active — — —

Root Cause

nginx cannot verify the SSL certificate presented by the upstream server, often due to self-signed certificate, expired certificate, or missing CA bundle.

generic

中文

nginx无法验证上游服务器提供的SSL证书，通常由自签名证书、证书过期或缺少CA包引起。

Official Documentation

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_trusted_certificate

Workarounds

  1. 85% success Add the upstream's CA certificate to nginx's trusted store: proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt; proxy_ssl_verify on; proxy_ssl_verify_depth 2; 
    Add the upstream's CA certificate to nginx's trusted store:
proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
  2. 75% success If using a self-signed certificate, add it to the trusted store or temporarily disable verification for testing: proxy_ssl_verify off; # Only for testing, not production 
    If using a self-signed certificate, add it to the trusted store or temporarily disable verification for testing:
proxy_ssl_verify off;  # Only for testing, not production

中文步骤

  1. 将上游的CA证书添加到nginx的信任存储：
proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
  2. 如果使用自签名证书，将其添加到信任存储或临时禁用验证进行测试：
proxy_ssl_verify off;  # 仅用于测试，不用于生产环境

Dead Ends

Common approaches that don't work:

  1. Disable SSL verification entirely (proxy_ssl_verify off) 60% fail

    This removes security without fixing the certificate issue; upstream may still reject connections.

  2. Restart nginx service 90% fail

    Restarting does not update certificate stores or fix certificate chain issues.

  3. Increase proxy_ssl_handshake_timeout 95% fail

    Timeout does not address certificate validation failure.