# Does proxy\_ssl\_verify verify server name?

**URL:** <https://www.ruby-forum.com/t/does-proxy-ssl-verify-verify-server-name/244040>\
**Category:** NGINX\
**Created:** [February 10, 2016, 5:25pm UTC](https://www.ruby-forum.com/t/does-proxy-ssl-verify-verify-server-name/244040 "2016-02-10T17:25:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [February 10, 2016, 5:25pm UTC](https://www.ruby-forum.com/t/does-proxy-ssl-verify-verify-server-name/244040/1 "2016-02-10T17:25:33Z")

</div>

Hello  
I’m trying to enable this option on a proxy\_pass location:

```
 proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
 proxy_ssl_verify on;
 proxy_ssl_verify_depth 9

```

/etc/ssl/certs/ca-certificates.crt is compiled by update-ca-certificates  
([Ubuntu Manpage: update-ca-certificates - update /etc/ssl/certs and certificates.crt](http://manpages.ubuntu.com/manpages/trusty/man8/update-ca-certificates.8.html))

My understanding is that this option will prevent, for example,  
self-signed certificates or certificates where the server name requested  
is different than in the certificate, is that correct?

I have tried it and while it works for self-signed (returns 502) it  
still lets a non matching server name through the proxy (properly signed  
certificate, but wrong name)

Thanks  
Richard

---

<div class="post-metadata">

**Author:** ![rkoskela](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@rkoskela](https://www.ruby-forum.com/u/rkoskela)\
**Post date:** [February 10, 2016, 6:28pm UTC](https://www.ruby-forum.com/t/does-proxy-ssl-verify-verify-server-name/244040/2 "2016-02-10T18:28:04Z")

</div>

Hello!

On Wed, Feb 10, 2016 at 04:25:06PM +0000, Richard K. wrote:

> certificates or certificates where the server name requested is different  
> than in the certificate, is that correct?

Yes.

> I have tried it and while it works for self-signed (returns 502) it still  
> lets a non matching server name through the proxy (properly signed  
> certificate, but wrong name)

Please provide an example.

–  
Maxim D.

> **[nginx](http://nginx.org/)**