# Nginx client authentication with 2 intermediate CAs

**URL:** <https://www.ruby-forum.com/t/nginx-client-authentication-with-2-intermediate-cas/244168>\
**Category:** NGINX\
**Created:** [February 29, 2016, 7:19pm UTC](https://www.ruby-forum.com/t/nginx-client-authentication-with-2-intermediate-cas/244168 "2016-02-29T19:19:35Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\
**Post date:** [February 29, 2016, 7:19pm UTC](https://www.ruby-forum.com/t/nginx-client-authentication-with-2-intermediate-cas/244168/1 "2016-02-29T19:19:35Z")

</div>

I’m trying to get nginx to verify client certificate issued through the  
following chain, with self-signed root: Root CA =\> Signing CA =\>  
Subordinate  
CA =\> Client cert.

I installed root\_CA.crt on the server, and on the client side, the certs  
are  
concatenated with cat client.crt subordinate\_CA.crt signing\_CA.crt \>  
cert-chain.pem. My nginx setting looks like this:

ssl\_client\_certificate /path/to/root\_CA.crt;  
ssl\_verify\_client on;  
ssl\_verify\_depth 3;

I tried to connect with curl -k server.url:443 --cert cert-chain.pem but  
it  
gives me error curl: (35) error reading X.509 key or certificate file.  
If I  
try that with --key client.key then it gives me 400 Bad Request. I also  
tried to test with openssl s\_client and the result is similar.

I’ve verified that the nginx setting works if I have no intermediate CA,  
i.e., Root CA =\> Client cert. It also works if my intermediate CA certs  
are  
installed on the server and only the leaf cert is on the client side.  
However, in our case, the Signing CA and Subordinate CA certs cannot be  
installed on server ahead of time. Any idea what to try next?

Posted at Nginx Forum:

> **[nginx client authentication with 2 intermediate CAs](https://forum.nginx.org/read.php?2,264942,264942#msg-264942)**
>
> I'm trying to get nginx to verify client certificate issued through the following chain, with self-signed root: Root CA =\> Signing CA =\> Subordinate CA =\> Client cert. I installed root\_CA.crt on the server, and on the client side, the certs...