Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We currently have a single nginx server running as a backend proxy for 4-5 Apache servers. my problem is that after installing the ssl certificate i get the following error when testing the ssl connection: openssl s_client -connect xxx.xxxxxxxxx.xxx:443 | more

Verify return code: 21 (unable to verify the first certificate)

The SSL was purchased through RapidSSL nginx's config is as follows for the ssl proxy:

server {
        listen 443 ssl;
        server_name _;
        access_log /var/log/nginx/ssl-access.log;
        error_log  /var/log/nginx/ssl-error.log;

        ssl                     on;
        ssl_certificate         ssl/wildcard-xxxxxxx.xx.xx.crt;
        ssl_certificate_key     ssl/wildcard-xxxxxxx.xx.xx.key;
        keepalive_timeout       60;

        location / {
            proxy_pass https://backend;
        }
}

I can verify that the backend servers return the ssl connection ok

Verify return code: 0 (ok)

if anyone could give me a heads up or a pointed would be greatly appreciated.

Thnx, David

share|improve this question
    
Please check out what "server_name _;" does. It does not do what you think it does. Use "listen 443 default_server ssl;" instead. Reference. –  Gnarfoz Jul 9 '12 at 17:58

1 Answer 1

up vote 1 down vote accepted

RapidSSL does not directly sign certificate by recognized Certificate Authority, but uses intermediate certiface to sign wildcard certificates. Browser / OpenSSL does not have intermediate certificate in it's trust chain, so it cannot validate SSL cert.

You have to install intermediate certificate in nginx. Get intermediate certificate (it should be included in your purchase / customer service instructions) and append it to your certificate.

 cat /path/to/intermediate.pem >> ssl/wildcard-xxxxxxx.xx.xx.crt  
share|improve this answer
    
Hi, Thanks for your update, any idea where i can find this intermediate certificate? i can find the root one here: geotrust.com/resources/root_certificates/certificates/… but this don't seam to be working :S –  davidcollom May 11 '11 at 16:45
1  
notepad.cc/frosseetru61 –  Kristaps May 11 '11 at 17:10

protected by Iain Feb 1 '12 at 8:30

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.