nginx auth_error ai_generated true

与上游SSL握手时证书验证失败

SSL certificate verify failed while SSL handshaking to upstream

ID: nginx/ssl-certificate-verify-failed-upstream

其他格式: JSON · Markdown 中文 · English
85%修复率
87%置信度
1证据数
2023-09-05首次发现

版本兼容性

版本状态引入弃用备注
nginx 1.18.0 active — — —
nginx 1.20.2 active — — —
nginx 1.22.1 active — — —

根因分析

nginx无法验证上游服务器提供的SSL证书，通常由自签名证书、证书过期或缺少CA包引起。

English

nginx cannot verify the SSL certificate presented by the upstream server, often due to self-signed certificate, expired certificate, or missing CA bundle.

generic

官方文档

https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_trusted_certificate

解决方案

  1. 将上游的CA证书添加到nginx的信任存储：
proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
  2. 如果使用自签名证书，将其添加到信任存储或临时禁用验证进行测试：
proxy_ssl_verify off;  # 仅用于测试，不用于生产环境

无效尝试

常见但无效的做法:

  1. Disable SSL verification entirely (proxy_ssl_verify off) 60% 失败

    This removes security without fixing the certificate issue; upstream may still reject connections.

  2. Restart nginx service 90% 失败

    Restarting does not update certificate stores or fix certificate chain issues.

  3. Increase proxy_ssl_handshake_timeout 95% 失败

    Timeout does not address certificate validation failure.