The documentation for
Specifies a file with trusted CA certificates in the PEM format used to verify client certificates and OCSP responses if
The list of certificates will be sent to clients. If this is not desired, the
ssl_trusted_certificatedirective can be used.
Why is this list sent to clients? I thought the client verification process has the client send its cert (and intermediates) to the server for verification. Is this inefficient if the file this property points to is large?
On the flip side, it says to use
ssl_trusted_certificate if you don't want to send the certificates to the client. If I remove
ssl_client_certificate and only set
ssl_trusted_certificate then nginx doesn't start since I have