Hello!

On Thu, Jan 30, 2020 at 10:55:03AM -0500, slowgary wrote:

> Thanks for the correction Maxim. I tested this before posting by using an
> old certificate. Nginx did not throw an error but the browser did notify
> that the connection was insecure.

Depending on what exactly "certificate chain validation" in the
original question was intended to mean, there may be at least
three cases considered:

1. Certificate chains as configured for nginx itself, by using
within the ssl_certificate directive
(http://nginx.org/r/ssl_certificate). For these certificates
nginx does not try to do any validation (and in most cases it
simply can't do it - in particular, because it doesn't know the
name to be used by clients, and doesn't have a root certificate to
validate against).

2. Certificate chains as presented by a client, as per the
ssl_verify_client directive
(http://nginx.org/r/ssl_verify_client). These chains are always
properly validated, including expiration of all intermediate
certificates and the certificate itself.

3. Certificate chains as presented by an upstream server, when
using proxy_pass to an https://... URL. These chains are properly
validated as long as the proxy_ssl_verify directive is on
(http://nginx.org/r/proxy_ssl_verify). Note though that this is
not the default behaviour, and by default nginx will not try to
validate upstream server certificates at all.

Given that the original question asks if nginx will "proceed or
will it break the connection", I suspect the question is either
about (2) or (3), as (1) hardly make sense during a particular
connection handling.

If you think that you see nginx accepting an expired certificate
from a client, or accepting an expired certificate from an
upstream server with proxy_ssl_verify switched on - please report
more details.

If you've assumed (1), the statement you've made is anyway too
broad to be true, as clearly nginx _does_ validate the expiration
date of certificates - as long as it does any validation at all.

--
Maxim Dounin
http://mdounin.ru/
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx