title: using ssl_verify_client on, I receive "No Required SSL certificate was sent"
body: <h2>Summary</h2>
  
  <p>I am running an nginx docker container, a self-signed cert, and I am testing connectivity via the command line curl.
  As long as I do not use ssl_verify_client, I am able to connect to the server without issue.  But when using it, I receive</p>
  
  <pre><code>400 No required SSL certificate was sent
  </code></pre>
  
  <p>There are a lot of variables, and I must be missing something, so I will show the steps.</p>
  
  <h2>Steps</h2>
  
  <h3>Certificate creation (via openssl)</h3>
  
  <ul>
  <li>cert_config.txt:</li>
  </ul>
  
  <pre><code>[req]
  default_bits = 2048
  prompt = no
  default_md = sha256
  req_extensions = req_ext
  distinguished_name = dn
  
  [ dn ]
  C=US
  ST=ThisState
  L=MyCity
  O=MyOrganization
  OU=MyOU
  emailAddress=emailaddess@domain.com
  CN=my-srv-01
  
  [ req_ext ]
  subjectAltName = @alt_names
  
  [ alt_names ]
  DNS.1 = my-srv-01
  </code></pre>
  
  <ul>
  <li>generation of the certs:</li>
  </ul>
  
  <pre><code>openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout nginx-selfsigned.key -out nginx-selfsigned.crt  -extensions req_ext -config cert_config.txt
  openssl genrsa -out client.key 2048
  openssl req -new -key client.key -out client.csr -extensions req_ext -config cert_config.txt
  openssl x509 -req -days 365 -sha256 -in client.csr -CA nginx-selfsigned.crt -CAkey nginx-selfsigned.key -set_serial 2 -out client.crt
  openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12
  </code></pre>
  
  <h3>Nginx configuration</h3>
  
  <pre><code>server { 
      listen       443 ssl;
      server_name  my-srv-01;
      root         html;
      ssl_certificate_key /etc/nginx/conf.d/nginx-selfsigned.key;
      ssl_certificate /etc/nginx/conf.d/nginx-selfsigned.crt;
      ssl_client_certificate /etc/nginx/conf.d/client.crt;
      ssl_verify_client on;
  
      location / {
       root   /usr/share/nginx/html;
      index  index.html index.htm;
      }
  }
  </code></pre>
  
  <h3>Testing with curl:</h3>
  
  <pre><code>curl -k -v -key /etc/nginx/conf.d/nginx-selfsigned.key -cacert /etc/nginx/conf.d/nginx-selfsigned.crt -cert /etc/nginx/conf.d/client.crt https://my-srv-01
  </code></pre>
  
  <p>yields (amongst the html and connection parameters):</p>
  
  <pre><code>400 No required SSL certificate was sent
  </code></pre>
  
  <p>But if I remove the ssl_verify_client option, curl displays the proper webpage.</p>
  
  <p>I'm obviously missing something, any help is appreciated!</p>