Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently have a single nginx server running as a backend proxy for 4-5 Apache servers. my problem is that after installing the ssl certificate i get the following error when testing the ssl connection: openssl s_client -connect | more

Verify return code: 21 (unable to verify the first certificate)

The SSL was purchased through RapidSSL nginx's config is as follows for the ssl proxy:

server {
        listen 443 ssl;
        server_name _;
        access_log /var/log/nginx/ssl-access.log;
        error_log  /var/log/nginx/ssl-error.log;

        ssl                     on;
        ssl_certificate         ssl/wildcard-xxxxxxx.xx.xx.crt;
        ssl_certificate_key     ssl/wildcard-xxxxxxx.xx.xx.key;
        keepalive_timeout       60;

        location / {
            proxy_pass https://backend;

I can verify that the backend servers return the ssl connection ok

Verify return code: 0 (ok)

if anyone could give me a heads up or a pointed would be greatly appreciated.

Thnx, David

share|improve this question
Please check out what "server_name _;" does. It does not do what you think it does. Use "listen 443 default_server ssl;" instead. Reference. – Gnarfoz Jul 9 '12 at 17:58
up vote 1 down vote accepted

RapidSSL does not directly sign certificate by recognized Certificate Authority, but uses intermediate certiface to sign wildcard certificates. Browser / OpenSSL does not have intermediate certificate in it's trust chain, so it cannot validate SSL cert.

You have to install intermediate certificate in nginx. Get intermediate certificate (it should be included in your purchase / customer service instructions) and append it to your certificate.

 cat /path/to/intermediate.pem >> ssl/wildcard-xxxxxxx.xx.xx.crt  
share|improve this answer
Hi, Thanks for your update, any idea where i can find this intermediate certificate? i can find the root one here:… but this don't seam to be working :S – davidcollom May 11 '11 at 16:45
1 – Kristaps May 11 '11 at 17:10

protected by Iain Feb 1 '12 at 8:30

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.