title: How to force Nginx to verify upstream certificates against the hostnames present in upstream server block?
body: <p>I am trying to implement HTTPS protocol communication at every layer of a proxying path. My proxying path is from client to load balancer (nginx) and then from nginx to the upstream server. </p>
  
  <p>I am facing a problem when the request is proxied from nginx to the upstream server.</p>
  
  <p>I am getting the following error in the nginx logs </p>
  
  <pre><code>2017/03/26 19:08:39 [error] 76753#0: *140 upstream SSL certificate does not match "8ba0c0da44ee43ea894987ab01cf4fbc" while SSL handshaking to upstream, client: 10.191.200.230, server: abc.uscom-central-1.ssenv.opcdev2.oraclecorp.com, request: "GET /a/a.html HTTP/1.1", upstream: "https://10.240.81.28:8001/a/a.html", host: "abc.uscom-central-1.ssenv.opcdev2.oraclecorp.com:10003"
  </code></pre>
  
  <p>This is my configuration for the upstream server block </p>
  
  <pre><code>upstream 8ba0c0da44ee43ea894987ab01cf4fbc {
                              server slc01etc.us.oracle.com:8001 weight=1;
                      keepalive 100;
  }
  
  proxy_pass https://8ba0c0da44ee43ea894987ab01cf4fbc;
  proxy_set_header Host $host:10003;
  proxy_set_header WL-Proxy-SSL true;
  proxy_set_header IS_SSL ssl;
  proxy_ssl_trusted_certificate /u01/data/secure_artifacts/ssl/trusted_certs/trusted-cert.pem;
  proxy_ssl_verify on;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  </code></pre>
  
  <p>When the request goes from Nginx to the upstream server, nginx matches the upstream ssl certificate against the pattern present in the proxy_pass directive. But my upstream ssl certificate pattern is the upstream server hostname (slc01etc.us.oracle.com) . </p>
  
  <p>Is there any way, where I can force Nginx to verify the upstream ssl certificate against the server hostnames provided in the upstream server block, instead of the pattern present in the proxy_pass directibve?</p>