# SSL certificate verify failed while SSL handshaking to upstream

- **ID:** `nginx/ssl-certificate-verify-failed-upstream`
- **Domain:** nginx
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

nginx cannot verify the SSL certificate presented by the upstream server, often due to self-signed certificate, expired certificate, or missing CA bundle.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| nginx 1.18.0 | active | — | — |
| nginx 1.20.2 | active | — | — |
| nginx 1.22.1 | active | — | — |

## Workarounds

1. **Add the upstream's CA certificate to nginx's trusted store:
proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;** (85% success)
   ```
   Add the upstream's CA certificate to nginx's trusted store:
proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
   ```
2. **If using a self-signed certificate, add it to the trusted store or temporarily disable verification for testing:
proxy_ssl_verify off;  # Only for testing, not production** (75% success)
   ```
   If using a self-signed certificate, add it to the trusted store or temporarily disable verification for testing:
proxy_ssl_verify off;  # Only for testing, not production
   ```

## Dead Ends

- **Disable SSL verification entirely (proxy_ssl_verify off)** — This removes security without fixing the certificate issue; upstream may still reject connections. (60% fail)
- **Restart nginx service** — Restarting does not update certificate stores or fix certificate chain issues. (90% fail)
- **Increase proxy_ssl_handshake_timeout** — Timeout does not address certificate validation failure. (95% fail)