Hello! On Thu, Jan 30, 2020 at 10:55:03AM -0500, slowgary wrote:
> Thanks for the correction Maxim. I tested this before posting by using an > old certificate. Nginx did not throw an error but the browser did notify > that the connection was insecure. Depending on what exactly "certificate chain validation" in the original question was intended to mean, there may be at least three cases considered: 1. Certificate chains as configured for nginx itself, by using within the ssl_certificate directive (http://nginx.org/r/ssl_certificate). For these certificates nginx does not try to do any validation (and in most cases it simply can't do it - in particular, because it doesn't know the name to be used by clients, and doesn't have a root certificate to validate against). 2. Certificate chains as presented by a client, as per the ssl_verify_client directive (http://nginx.org/r/ssl_verify_client). These chains are always properly validated, including expiration of all intermediate certificates and the certificate itself. 3. Certificate chains as presented by an upstream server, when using proxy_pass to an https://... URL. These chains are properly validated as long as the proxy_ssl_verify directive is on (http://nginx.org/r/proxy_ssl_verify). Note though that this is not the default behaviour, and by default nginx will not try to validate upstream server certificates at all. Given that the original question asks if nginx will "proceed or will it break the connection", I suspect the question is either about (2) or (3), as (1) hardly make sense during a particular connection handling. If you think that you see nginx accepting an expired certificate from a client, or accepting an expired certificate from an upstream server with proxy_ssl_verify switched on - please report more details. If you've assumed (1), the statement you've made is anyway too broad to be true, as clearly nginx _does_ validate the expiration date of certificates - as long as it does any validation at all. -- Maxim Dounin http://mdounin.ru/ _______________________________________________ nginx mailing list [email protected] http://mailman.nginx.org/mailman/listinfo/nginx
