title: NGinx SSL certificate authentication signed by intermediate CA (chain)
body: <p>I am trying to enable client certificate authentication in nginx where the certificates have been signed by an intermediate CA.  I am able to get this working fine when using a certificate signed by a self-signed root CA; however, this does not work when the signing CA is an intermediate CA.</p>
  
  <p>My simple server section looks like this:</p>
  
  <pre><code>server {
      listen       443;
      server_name  _;
  
      ssl                  on;
      ssl_certificate      cert.pem;
      ssl_certificate_key  cert.key;
  
      ssl_session_timeout  5m;
  
      ssl_protocols  SSLv2 SSLv3 TLSv1;
      ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
      ssl_prefer_server_ciphers   on;
  
      ssl_client_certificate ca.pem;
      ssl_verify_client on;
      ssl_verify_depth 1;
  
      location / {
          root   html;
          index  index.html index.htm;
      }
  }
  </code></pre>
  
  <p>For the contents of ca.pem, I have tried using <em>only</em> the intermediate CA and also concatenating the intermediate CA cert and the root CA cert, i.e. something like:</p>
  
  <pre><code>cp intermediate.crt ca.pem
  cat root.crt &gt;&gt; ca.pem
  </code></pre>
  
  <p>I have also validated that the certificate is valid from openssl's perspective when using that same CA chain:</p>
  
  <pre><code>openssl verify -CAfile /etc/nginx/ca.pem certs/client.crt 
  certs/client.crt: OK
  </code></pre>
  
  <p>I have experimented with setting ssl_verify_depth explicitly to 1 (as above) and then even 0 (not sure what that number means exactly), but still get same error.</p>
  
  <p>The error I get in all variants of the intermed CA is "400 Bad Request" and more specifically "The SSL certificate error"  (not sure what that means exactly).</p>
  
  <p>Maybe nginx just doesn't support cert chains for intermediate certs?  Any help greatly appreciated!</p>