# Proxy\_ssl\_certificate not working as expected **URL:** \ **Category:** NGINX\ **Created:** [March 13, 2016, 12:24pm UTC](https://www.ruby-forum.com/t/proxy-ssl-certificate-not-working-as-expected/244270 "2016-03-13T12:24:49Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\ **Post date:** [March 13, 2016, 12:24pm UTC](https://www.ruby-forum.com/t/proxy-ssl-certificate-not-working-as-expected/244270/1 "2016-03-13T12:24:49Z")
Hello, I’m using nginx as a proxy to a backend server. The backend server is also using nginx and enforcing client certificate authentication using the ssl\_client\_certificate and ssl\_verify\_client directives. In my nginx server I set the following: ``` location /proxy { proxy_pass https://www.backend.com; proxy_set_header X-Forwarded-Host $host; proxy_set_header X-Forwarded-Server $host; proxy_set_header X-Forwarded-For ``` $proxy\_add\_x\_forwarded\_for; ``` proxy_ssl_certificate /etc/nginx/cert/client.crt; proxy_ssl_certificate_key /etc/nginx/cert/client.key; } ``` according to [Module ngx\_http\_proxy\_module](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate). However, the backend is still responding with a 400 reponse code “No required SSL certificate was sent”. Note that when issuing requests to the backend server using wget with the client certificate, I get a valid 200 OK response. What am I missing in my nginx configuration? Posted at Nginx Forum: > **[proxy\_ssl\_certificate not working as expected](https://forum.nginx.org/read.php?2,265281,265281#msg-265281)** > > Hello, I'm using nginx as a proxy to a backend server. The backend server is also using nginx and enforcing client certificate authentication using the ssl\_client\_certificate and ssl\_verify\_client directives. In my nginx server I set the following: ---
**Author:** ![elanh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/e47c2d/32.png) [@elanh](https://www.ruby-forum.com/u/elanh)\ **Post date:** [March 16, 2016, 9:13pm UTC](https://www.ruby-forum.com/t/proxy-ssl-certificate-not-working-as-expected/244270/2 "2016-03-16T21:13:25Z")
Hello! On Sun, Mar 13, 2016 at 07:24:05AM -0400, elanh wrote: > ``` > proxy_pass https://www.backend.com; > > ``` > > [Module ngx\_http\_proxy\_module](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_certificate). > > However, the backend is still responding with a 400 reponse code “No > required SSL certificate was sent”. > > Note that when issuing requests to the backend server using wget with the > client certificate, I get a valid 200 OK response. > > What am I missing in my nginx configuration? Configuration looks fine, but likely it’s not a configuration which is used to handle the requests. Some basic hints: - make sure to test with something low level like telnet/curl/wget, browsers often return cached results; - check if the configuration is actually loaded (you can use “nginx -t” to check for syntax errors; look into error log after a configuration reload to make sure reload went fine; just stop and then start nginx to make sure); - make sure the location you are configuring is one used for requests (a simple test would be to write something like “return 200 ok;” in it and check if “ok” is actually returned). Note well that proxy\_ssl\_certificate is only available in nginx 1.7.8 and newer. Configuration testing as done by “nginx -t” should complain about unknown directives if you are using an older version. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![elanh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/e47c2d/32.png) [@elanh](https://www.ruby-forum.com/u/elanh)\ **Post date:** [March 28, 2016, 12:11pm UTC](https://www.ruby-forum.com/t/proxy-ssl-certificate-not-working-as-expected/244270/3 "2016-03-28T12:11:46Z")
Hello Maxim, The configuration is loaded correctly and is handling requests. “nginx -t” shows that all is OK and a 200 OK response is returned correctly. My front-end server is running version 1.9.10 (I ran “nginx -v”). So proxy\_ssl\_certificate is valid in my case. The backend server is running version 1.4.6 - but does this matter? Posted at Nginx Forum: > **[Re: proxy\_ssl\_certificate not working as expected](https://forum.nginx.org/read.php?2,265281,265682#msg-265682)** > > Hello, I'm using nginx as a proxy to a backend server. The backend server is also using nginx and enforcing client certificate authentication using the ssl\_client\_certificate and ssl\_verify\_client directives. In my nginx server I set the following: ---
**Author:** ![elanh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/e47c2d/32.png) [@elanh](https://www.ruby-forum.com/u/elanh)\ **Post date:** [March 28, 2016, 12:44pm UTC](https://www.ruby-forum.com/t/proxy-ssl-certificate-not-working-as-expected/244270/4 "2016-03-28T12:44:29Z")
Here is my full “nginx -V” output: nginx version: nginx/1.9.10 built by gcc 4.9.2 (Debian 4.9.2-10) built with OpenSSL 1.0.1k 8 Jan 2015 TLS SNI support enabled configure arguments: --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx –conf-path=/etc/nginx/nginx.conf –error-log-path=/var/log/nginx/error.log –http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid –lock-path=/var/run/nginx.lock –http-client-body-temp-path=/var/cache/nginx/client\_temp –http-proxy-temp-path=/var/cache/nginx/proxy\_temp –http-fastcgi-temp-path=/var/cache/nginx/fastcgi\_temp –http-uwsgi-temp-path=/var/cache/nginx/uwsgi\_temp –http-scgi-temp-path=/var/cache/nginx/scgi\_temp --user=nginx –group=nginx –with-http\_ssl\_module --with-http\_realip\_module –with-http\_addition\_module –with-http\_sub\_module --with-http\_dav\_module --with-http\_flv\_module –with-http\_mp4\_module --with-http\_gunzip\_module –with-http\_gzip\_static\_module --with-http\_random\_index\_module –with-http\_secure\_link\_module --with-http\_stub\_status\_module –with-http\_auth\_request\_module --with-threads --with-stream –with-stream\_ssl\_module --with-http\_slice\_module --with-mail –with-mail\_ssl\_module --with-file-aio --with-http\_v2\_module –with-cc-opt=‘-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D\_FORTIFY\_SOURCE=2’ –with-ld-opt=‘-Wl,-z,relro -Wl,–as-needed’ --with-ipv6 Posted at Nginx Forum: > **[Re: proxy\_ssl\_certificate not working as expected](https://forum.nginx.org/read.php?2,265281,265684#msg-265684)** > > Hello, I'm using nginx as a proxy to a backend server. The backend server is also using nginx and enforcing client certificate authentication using the ssl\_client\_certificate and ssl\_verify\_client directives. In my nginx server I set the following: