# 与上游SSL握手时证书验证失败

- **ID:** `nginx/ssl-certificate-verify-failed-upstream`
- **领域:** nginx
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 85%

## 根因

nginx无法验证上游服务器提供的SSL证书，通常由自签名证书、证书过期或缺少CA包引起。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| nginx 1.18.0 | active | — | — |
| nginx 1.20.2 | active | — | — |
| nginx 1.22.1 | active | — | — |

## 解决方案

1. ```
   将上游的CA证书添加到nginx的信任存储：
proxy_ssl_trusted_certificate /etc/nginx/ssl/upstream-ca.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
   ```
2. ```
   如果使用自签名证书，将其添加到信任存储或临时禁用验证进行测试：
proxy_ssl_verify off;  # 仅用于测试，不用于生产环境
   ```

## 无效尝试

- **Disable SSL verification entirely (proxy_ssl_verify off)** — This removes security without fixing the certificate issue; upstream may still reject connections. (60% 失败率)
- **Restart nginx service** — Restarting does not update certificate stores or fix certificate chain issues. (90% 失败率)
- **Increase proxy_ssl_handshake_timeout** — Timeout does not address certificate validation failure. (95% 失败率)