title: Client SSL with an Intermediate Certificate
body: <p>I have a self-signed root certificate and an intermediate certificated signed by that root. Basically something like this:</p>
  
  <pre><code>.
  └── master (CA)
      └── servant1 (CA)
  </code></pre>
  
  <p>I have a few client certificates which are derived from  the <code>master-&gt;servant1</code> certificate chain:</p>
  
  <pre><code>.
  └── master (CA)
      └── servant1 (CA)
          ├── client1
          ├── client2
          └── client3
  </code></pre>
  
  <p>I'm looking to authenticate these client certificates in nginx and I'm having a lot of trouble doing so.</p>
  
  <p>Here's my nginx configuration:</p>
  
  <pre><code>upstream luci {
      server localhost:8080;
  }
  
  server {
      listen                  127.0.0.1:80;
      server_name             myserver;
  
      return 301 https://$host$request_uri;
  }
  
  server {
      listen                  127.0.0.1:443;
      server_name             myserver;
  
      ssl                     on;
      ssl_certificate         /etc/nginx/certs/myserver.crt;
      ssl_certificate_key     /etc/nginx/certs/myserver.key;
  
      ssl_session_timeout 5m;
  
      ssl_prefer_server_ciphers on;
      ssl_protocols TLSv1.2 TLSv1.1;
      ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AES:!ECDH+3DES:!DH+3DES:!RSA+3DES:!aNULL:!MD5:!DSS;
  
      ssl_client_certificate /etc/nginx/certs/servant1-ca-chain.crt;
      ssl_verify_client on;
      ssl_verify_depth 2;
  
      location / {
          proxy_pass http://luci;
      }
  }
  </code></pre>
  
  <p>This should be pretty straightforward. All client certificates signed by the intermediate <code>servant1</code> CA should be allowed to connect to nginx.</p>
  
  <p>However, when I attempt to access the server with these client certificates, I get this:</p>
  
  <p><img src="https://i.imgur.com/xLlU0eG.png" alt="a"></p>
  
  <p><sup>(obviously an incredibly detailed and helpful error)</sup></p>
  
  <p>I find this in my logs:</p>
  
  <pre><code>2013/12/01 22:46:18 [alert] 7478#0: *5 ignoring stale global SSL error (SSL: error:0407006A:lib(4):func(112):reason(106) error:04067072:lib(4):func(103):reason(114) error:0D0C5006:lib(13):func(197):reason(6)) while reading client request line, client: 192.168.1.208, server: myserver
  </code></pre>
  
  <p>Useful information here is:</p>
  
  <blockquote>
    <p>ignoring stale global SSL error</p>
  </blockquote>
  
  <p>What's going wrong and how can I fix it?</p>