3

I am Migrating from an Apache Web Server to Nginx and i need an alternative of apache's SSLCACertificateFile in nginx library.

I have used :-

ssl_certificate as alternative of SSLCertificateFile and ssl_certificate_key as alternative of SSLCertificateKeyFile.

But didn't get any alternative for SSLCACertificateFile .

Any suggestion would be helpful??

Improve this question

3 Answers 3

Reset to default
5

Are you sure you need SSLCaCertificateFile? This is for client authentication. Don't you need SSLCertificateChainFile to provide intermediate certificates?

In the later case just append your intermediates to the file referenced as ssl_certificate.

If you really are after client authentication, check ssl_client_certificate / ssl_client_verify directives.

Improve this answer
5
  • I have following in my apache config file.. SSLCACertificateFile "/some/path/cachainpem.txt" I just need an alternative to perform the same using nginx Is this can be achieved using ssl_client_certificate / ssl_client_verify directives?
    – Varun Chawla
    Feb 10, 2015 at 13:04
  • 2
    Well no, that's what I suspected. Your apache configuration is actually wrong. SSLCACertificateFile does not do want you think it does. SSLCertificateChainFile would be the correct directive in apache. And as written in my answer, the way to do that in nginx is to append the content from your cachainpem.txt to the file specified as ssl_certificate in nginx.
    – andrekeller
    Feb 10, 2015 at 13:06
  • I have append the content from cachainpem.txt to the file specified as ssl_certificate in nginx and getting this error. SSL: error:0906D066:PEM routines:PEM_read_bio:bad end line) Can you help me regarding this error?
    – Varun Chawla
    Feb 17, 2015 at 3:50
  • You probably made a copy paste error. The begin / end certificate, including the equal signs, lines around each certificate are mandatory. Check if you accidentally truncated one...
    – andrekeller
    Feb 19, 2015 at 11:48
  • Yeah, got it....!! It works Thanks a lot..
    – Varun Chawla
    Feb 20, 2015 at 19:19
5

Concatenate the CAbundle file and the certificate file. Then use this concatenate file for certification.

it will look like as follows,

    -----BEGIN CERTIFICATE-----
    MIIDojCCAooCCQChtMcSJsSqYzANBgkqhkiG9w0BAQUFADCBkjELMAkGA1UEBhMCVFcxCzAJBgNVBAgTAl
    -----END CERTIFICATE-----
    -----BEGIN CAbundle CERTIFICATE-----
    MIIDojCCAooCCQChtMcSJsSqYzANBgkqhkiG9w0BAQUFADCBkjELMAkGA1UEBhMCVFcxCzAJBgNVBAgTAl
    -----END CAbundle CERTIFICATE-----

References: https://support.comodo.com/index.php?/Knowledgebase/Article/View/1091/0/certificate-installation--nginx

Improve this answer
0
1

In Nginx, there is no SSLCACertificateFile [ Bundle ]

In order to work,

We need to append the bundle file with the .crt file.

Make sure .crt content would be at the top of the file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .