Nginx does not provide option to read the certificate chain

[MandeepSinghChhabra@…]

There is a server which has two known local CAs. One is a root ca (which is a self signed ca) and the other is an intermediate ca , signed by the root ca. Intermediate CA has issued a client certificate which is
shared with the client along with the chain(intermediate + root).

The chain looks as following:

ClientCert -> IntermediateCACert -> RootCACert

root ca certificate is the CA certificate which has been added in the trusted CA certificate list for the web.

From the client side, the chain is being used to establish the connection with the server. The connection gets established successfully.

Nginx does the SSL termination. Although there are options to fetch the client certificate (only the leaf certificate, using variable ssl_client_cert), there is no way to get the entire chain of certificates from Nginx.

[Maxim Dounin]

For the record, the reporter submitted ​a patch to address this. Here is the ​initial review. The main question is:

You may want to be more specific about which problem you are trying to solve. In particular, all root and intermediate certificates are expected to be known on the server. If they aren't for some reason, it might be a good idea to clarify why they aren't known or reconsider particular configuration.

[Maxim Dounin]

For the record, see additional comments ​here. In the particular use case checking $ssl_client_i_dn should be enough. Further, it is not really possible to provide full certificate chain, since it is not available for resumed SSL sessions.

[Maxim Dounin]

See also #2476.