# SSL client verification with chained CA

**URL:** <https://www.ruby-forum.com/t/ssl-client-verification-with-chained-ca/224097>\
**Category:** NGINX\
**Created:** [October 30, 2012, 11:17am UTC](https://www.ruby-forum.com/t/ssl-client-verification-with-chained-ca/224097 "2012-10-30T11:17:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\
**Post date:** [October 30, 2012, 11:17am UTC](https://www.ruby-forum.com/t/ssl-client-verification-with-chained-ca/224097/1 "2012-10-30T11:17:44Z")

</div>

Hi,

So far we were able to run nginx (1.0.x & 1.2.x) with SSL client  
verification enabled where certs were signed by single root CA:

ssl on;  
ssl\_certificate server\_cert\_signed\_by\_CA.pem;  
ssl\_certificate\_key server\_key.pem;  
ssl\_client\_certificate ca\_cert.pem;  
ssl\_verify\_client optional;

Now we would like to introduce chained CAs:

root CA → intermediate CA → client cert

so nginx should be able to verify client certificates which are signed  
by intermediate CA. Unfortunately I was not able make it working (I see  
that development version 1.3.x has some additional options which would  
suggest that this setup can work with it). Is this setup possible with  
nginx 1.2.x ?  
Some other people had identical problem:

> <https://stackoverflow.com/questions/8431528/nginx-ssl-certificate-authentication-signed-by-intermediate-ca-chain>

SSL module documentation ([Module ngx\_http\_ssl\_module](http://wiki.nginx.org/HttpSslModule))  
mentions that SSL module “supports checking client certificates with two  
limitations” whereas 2nd limitation seems to be related to server  
cetificate rather than client certificate. Is this a bad wording or am  
I missing something there ?  
Regards,

Marcin

---

<div class="post-metadata">

**Author:** ![marcind](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/cc9497/32.png) [@marcind](https://www.ruby-forum.com/u/marcind)\
**Post date:** [October 30, 2012, 12:39pm UTC](https://www.ruby-forum.com/t/ssl-client-verification-with-chained-ca/224097/2 "2012-10-30T12:39:08Z")

</div>

On Tue, 30 Oct 2012 11:17:41 +0100  
Marcin D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> would suggest that this setup can work with it). Is this setup  
> possible with nginx 1.2.x ?

I have enabled additional debugging and got this in logs:

client SSL certificate verify error: (26:unsupported certificate  
purpose) while SSL handshaking

Looks like our security team needs to re-generate certificates.  
I’m sorry for the noise.

Marcin