Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For a project as part of the European Grid Infrastructure (EGI) we need SSL client certificate verification for a service running on nginx. As there are several root CAs allowed within EGI, we need nginx to check them all during client certificate validation. In the documentation of nginx I could only find the parameter ssl_client_certificate which allows to specify just one file containing a root certificate.

Is there a way to specify more than one root CA for client certificate verification in nginx or do I have to use Apache for this?

share|improve this question
There is currently an ongoing discussion on the Nginx mailinglist on this topic. It seems Nginx only supports one file and you have to concatenate all CA certificates into that file. An open question is, which approach gives faster response times and if Nginx should support CA lookup via hash based filenames. – Florian Feldhaus Aug 10 '12 at 9:31
up vote 3 down vote accepted

< bot >Convert answer as comment in answer section< /bot >

Nginx support multiple root certificates. Just put multiple root CA certificates into a file specified in the ssl_client_certificate directive. Note the docs explicitly say "certificates"(plural).

This is a consideration why nginx doesn't support ssl_client_certificate in a directory (as Apache does)

"Certificate file" vs "certificate path" difference isn't about running something after updates of certificates or not (in both cases you have to update something, either cat to a single file or the c_rehash script to create symbolic links in case of CApath). The difference is about certificates in memory vs. certficates on disk, and the later implies syscalls and disk access on each certificate check.

As nginx is designed to work under high loads, with many requests (and handshakes) per second, it uses CAfile variant. And as nginx configuration reload is seamless, it's unlikely the CApath variant will add any extra value.

Maxim Dounin

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.