Nginx mTLS Client Cert Verification Fix

Threat/Impact Level: CRITICAL | Exploitability/Downtime Risk: HIGH | Time to Fix: 15 mins

TL;DR

• What broke: Nginx rejected the TLS handshake because it cannot verify the client's certificate against a trusted CA — caused by a missing ssl_client_certificate path, wrong ssl_verify_client directive, insufficient ssl_verify_depth, or a CA bundle/chain mismatch.
• How to fix it: Point ssl_client_certificate to the correct CA bundle (full chain), set ssl_verify_client on, and set ssl_verify_depth 2 (or higher for intermediate CAs).
• Fast path: Use our Client-Side Sandbox above to auto-refactor this — paste your failing Nginx server {} block and get the corrected config without sending your certs to any external server.

2024/01/15 03:42:17 [info] 12345#0: *88 client certificate verification failed: (20:unable to get local issuer certificate) while reading client request headers, client: 10.0.1.45, server: api.internal.example.com
HTTP/1.1 400 Bad Request

$ curl --cert client.crt --key client.key https://api.internal.example.com/health
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to api.internal.example.com:443
# Or the server returns:
<html>
<head><title>400 Bad Request</title></head>
<body><center><h1>400 No required SSL certificate was sent</h1></center></body>
</html>

How to Fix It (The Solution)

Basic Fix — Correct the Core Directives

The minimum viable fix is ensuring the CA bundle is correct, verification is enforced, and depth covers your chain.

 server {
     listen 443 ssl;
     server_name api.internal.example.com;
 
     ssl_certificate     /etc/nginx/certs/server.crt;
     ssl_certificate_key /etc/nginx/certs/server.key;
 
-    # WRONG: Points to the client's own cert, not the CA that signed it
-    ssl_client_certificate /etc/nginx/certs/client.crt;
-
-    # WRONG: 'optional' silently allows unauthenticated connections through
-    ssl_verify_client optional;
-
-    # WRONG: Default depth of 1 rejects any intermediate CA in the chain
-    ssl_verify_depth 1;
+    # CORRECT: Points to the CA bundle (or full chain) that ISSUED the client certs
+    ssl_client_certificate /etc/nginx/certs/trusted-ca-bundle.pem;
+
+    # CORRECT: Strictly require and verify a valid client certificate
+    ssl_verify_client on;
+
+    # CORRECT: Set depth >= 2 to allow Root CA -> Intermediate CA -> Client Cert chains
+    ssl_verify_depth 2;
 }

Verify your CA bundle is correct before reloading:

# Verify the client cert IS signed by the CA in your bundle
openssl verify -CAfile /etc/nginx/certs/trusted-ca-bundle.pem client.crt
# Expected: client.crt: OK
# If you see "unable to get local issuer certificate", your bundle is wrong or incomplete

# Check the full chain of your CA bundle
openssl crl2pkcs7 -nocrl -certfile /etc/nginx/certs/trusted-ca-bundle.pem \
  | openssl pkcs7 -print_certs -noout

# Test reload without downtime
nginx -t && nginx -s reload

Enterprise Best Practice — Full Hardened mTLS Server Block

 server {
     listen 443 ssl;
     server_name api.internal.example.com;
 
     ssl_certificate         /etc/nginx/certs/server-fullchain.pem;
     ssl_certificate_key     /etc/nginx/certs/server.key;
 
-    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-    ssl_ciphers ALL;
-    ssl_client_certificate /etc/nginx/certs/client.crt;
-    ssl_verify_client optional;
-    ssl_verify_depth 1;
-    # No OCSP, no session hardening, no error handling
+    # Enforce TLS 1.2+ only — drop legacy protocol support
+    ssl_protocols TLSv1.2 TLSv1.3;
+    ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305;
+    ssl_prefer_server_ciphers on;
+
+    # Full CA chain bundle — include ALL intermediate CAs that signed client certs
+    ssl_client_certificate  /etc/nginx/certs/trusted-ca-bundle.pem;
+
+    # Hard enforcement — no cert, no entry
+    ssl_verify_client       on;
+    ssl_verify_depth        3;
+
+    # OCSP stapling — reduces handshake latency and enables revocation checking
+    ssl_stapling            on;
+    ssl_stapling_verify     on;
+    ssl_trusted_certificate /etc/nginx/certs/trusted-ca-bundle.pem;
+    resolver                1.1.1.1 8.8.8.8 valid=300s;
+
+    # Expose verified client identity to upstream for authorization
+    proxy_set_header X-SSL-Client-Cert      $ssl_client_escaped_cert;
+    proxy_set_header X-SSL-Client-DN        $ssl_client_s_dn;
+    proxy_set_header X-SSL-Client-Verify    $ssl_client_verify;
+
+    # Return structured error for cert failures — avoid leaking Nginx version
+    error_page 400 /mtls_error.html;
+    server_tokens off;
 
     location / {
+        # Upstream guard: reject if cert verification did not succeed
+        if ($ssl_client_verify != SUCCESS) {
+            return 403 '{"error":"client_cert_required","detail":"mTLS verification failed"}\n';
+        }
         proxy_pass http://backend_upstream;
     }
 }

Key enterprise additions explained:

• ssl_trusted_certificate + ssl_stapling_verify on — enables OCSP stapling verification against your CA's OCSP responder
• $ssl_client_verify guard in location block — double-checks at the application layer even if Nginx's ssl_verify_client passes (defense in depth)
• $ssl_client_s_dn forwarded upstream — lets your backend perform RBAC based on the client cert's Subject DN (e.g., CN=service-account-payments,O=internal)
• ssl_verify_depth 3 — handles Root CA → Intermediate CA → Issuing CA → Client Cert four-level chains common in enterprise PKI (Vault PKI, EJBCA, AWS Private CA)

💡 Tired of pasting proprietary infrastructure configs into public LLMs? Generic AI interfaces log your company's ARNs, connection strings, and private keys. StackEngine enforces client-side zero-trust boundaries—the sandbox above executes 100% locally in your browser. Drop your broken manifest above to redact secrets locally and synthesize deterministic patch drafts with your own API key.

(For CI/CD pipeline automation, install via npm i -g stackengine).

# policy/nginx_mtls.rego
package nginx.mtls

deny[msg] {
    input.server.ssl_verify_client == "optional"
    msg := "POLICY VIOLATION: ssl_verify_client must be 'on', not 'optional'. mTLS bypass risk."
}

deny[msg] {
    input.server.ssl_verify_client == "off"
    msg := "POLICY VIOLATION: ssl_verify_client is disabled. mTLS not enforced."
}

deny[msg] {
    not input.server.ssl_client_certificate
    msg := "POLICY VIOLATION: ssl_client_certificate (CA bundle) is not defined."
}

deny[msg] {
    depth := input.server.ssl_verify_depth
    depth < 2
    msg := sprintf("POLICY VIOLATION: ssl_verify_depth is %d. Must be >= 2 for intermediate CA chains.", [depth])
}

# Run in CI pipeline
conftest test nginx.conf --policy policy/nginx_mtls.rego

# If you manage Nginx via Kubernetes Ingress, scan the manifest
checkov -d ./helm/nginx-ingress --framework kubernetes \
  --check CKV_K8S_36  # Enforce TLS on ingress

# Custom check for mTLS annotation presence
# nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
# nginx.ingress.kubernetes.io/auth-tls-secret: "namespace/ca-secret"

#!/bin/bash
# ci/validate-mtls-certs.sh — Run this BEFORE nginx -s reload in your pipeline
set -euo pipefail

CA_BUNDLE="${1:-/etc/nginx/certs/trusted-ca-bundle.pem}"
TEST_CLIENT_CERT="${2:-/etc/nginx/certs/test-client.crt}"

echo "[mTLS Preflight] Verifying CA bundle integrity..."
openssl crl2pkcs7 -nocrl -certfile "$CA_BUNDLE" | openssl pkcs7 -print_certs -noout

echo "[mTLS Preflight] Verifying test client cert against CA bundle..."
if ! openssl verify -CAfile "$CA_BUNDLE" "$TEST_CLIENT_CERT" > /dev/null 2>&1; then
  echo "FATAL: Client cert verification failed against CA bundle. Aborting deploy."
  exit 1
fi

echo "[mTLS Preflight] Nginx config syntax check..."
nginx -t

echo "[mTLS Preflight] All checks passed. Safe to reload."

# prometheus/alerts/mtls_cert_expiry.yaml
groups:
  - name: mtls_cert_health
    rules:
      - alert: NginxClientCABundleExpiryWarning
        expr: (probe_ssl_earliest_cert_expiry{job="nginx-mtls-probe"} - time()) / 86400 < 30
        for: 1h
        labels:
          severity: warning
        annotations:
          summary: "Nginx mTLS CA bundle expires in < 30 days"
          description: "Rotate the CA bundle at ssl_client_certificate before expiry causes a 400 outage."