# How to load a TRUSTED Client CA

**URL:** <https://www.ruby-forum.com/t/how-to-load-a-trusted-client-ca/215530>\
**Category:** NGINX\
**Created:** [January 7, 2012, 4:13am UTC](https://www.ruby-forum.com/t/how-to-load-a-trusted-client-ca/215530 "2012-01-07T04:13:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [January 7, 2012, 4:13am UTC](https://www.ruby-forum.com/t/how-to-load-a-trusted-client-ca/215530/1 "2012-01-07T04:13:11Z")

</div>

I need to specify a CA file to “ssl\_client\_certificate” directive. This  
crt is generated by openssl x509 command with “-trustout” parameter, so  
starts with “----BEGIN TRUSTED CERTIFICATE-----”, rather than common  
“-----BEGIN CERTIFICATE-----”.

Nginx will report error:  
PEM routines:PEM\_read\_bio:no start line

Internally, nginx uses openssl’s API “SSL\_load\_client\_CA\_file()” to load  
the cert and report this error.

So it’s a bug, expected or I mis-configure somewhere?

Thanks.

Posted at Nginx Forum:

> **[How to load a TRUSTED Client CA](https://forum.nginx.org/read.php?2,220897,220897#msg-220897)**
>
> I need to specify a CA file to "ssl\_client\_certificate" directive. This crt is generated by openssl x509 command with "-trustout" parameter, so starts with "----BEGIN TRUSTED CERTIFICATE-----", rather than common...

---

<div class="post-metadata">

**Author:** ![speedfirst](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/e19adc/32.png) [@speedfirst](https://www.ruby-forum.com/u/speedfirst)\
**Post date:** [January 8, 2012, 12:11am UTC](https://www.ruby-forum.com/t/how-to-load-a-trusted-client-ca/215530/2 "2012-01-08T00:11:36Z")

</div>

Hello!

On Fri, Jan 06, 2012 at 10:12:20PM -0500, speedfirst wrote:

> So it’s a bug, expected or I mis-configure somewhere?

I suspect this is the result of the whole trust thing being  
experimental in OpenSSL.

OpenSSL’s s\_server sample server won’t load such certificates as  
well. It uses the same SSL\_load\_client\_CA\_file() function to  
handle -CAfile argument. Note though that it won’t complain as it  
lacks error checking after the call, you should explicitly test  
whether it was loaded by checking CA names list on connect. On  
the other hand, “openssl verify” is able to handle such certs, so  
it’s probably expected to work. You may try asking OpenSSL’s guys  
for details.

Easiest solution probably is to convert the cert to a normal one,  
something like this will do the trick:

$ openssl x509 -in trusted.cert.pem -clrtrust -out normal.cert.pem

Maxim D.