We currently have a single nginx server running as a backend proxy for 4-5 Apache servers. my problem is that after installing the ssl certificate i get the following error when testing the ssl connection: openssl s_client -connect xxx.xxxxxxxxx.xxx:443 | more

Verify return code: 21 (unable to verify the first certificate)

The SSL was purchased through RapidSSL nginx's config is as follows for the ssl proxy:

server {
        listen 443 ssl;
        server_name _;
        access_log /var/log/nginx/ssl-access.log;
        error_log  /var/log/nginx/ssl-error.log;

        ssl                     on;
        ssl_certificate         ssl/wildcard-xxxxxxx.xx.xx.crt;
        ssl_certificate_key     ssl/wildcard-xxxxxxx.xx.xx.key;
        keepalive_timeout       60;

        location / {
            proxy_pass https://backend;

I can verify that the backend servers return the ssl connection ok

Verify return code: 0 (ok)

if anyone could give me a heads up or a pointed would be greatly appreciated.

Thnx, David

  • Please check out what "server_name _;" does. It does not do what you think it does. Use "listen 443 default_server ssl;" instead. Reference. – Gnarfoz Jul 9 '12 at 17:58

RapidSSL does not directly sign certificate by recognized Certificate Authority, but uses intermediate certiface to sign wildcard certificates. Browser / OpenSSL does not have intermediate certificate in it's trust chain, so it cannot validate SSL cert.

You have to install intermediate certificate in nginx. Get intermediate certificate (it should be included in your purchase / customer service instructions) and append it to your certificate.

 cat /path/to/intermediate.pem >> ssl/wildcard-xxxxxxx.xx.xx.crt  

protected by Iain Feb 1 '12 at 8:30

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.