Welcome! Log In Create A New Profile

Advanced

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

PGNet Dev
June 02, 2020 01:00AM
with patch applied, and 'proxy_ssl_server_name on;'

this is where the problem appears

2020/06/02 00:50:08 [debug] 20166#20166: *3 verify:1, error:0, depth:2, subject:"/O=example.com/OU=example.com_CA/L=New_York/ST=NY/C=US/emailAddress=admin@example.com/CN=example.com_CA", issuer:"/O=example.com/OU=example.com_CA/L=New_York/ST=NY/C=US/emailAddress=admin@example.com/CN=example.com_CA"
2020/06/02 00:50:08 [debug] 20166#20166: *3 verify:1, error:0, depth:1, subject:"/C=US/ST=NY/O=example.com/OU=example.com_CA/CN=example.com_CA_INTERMEDIATE/emailAddress=admin@example.com", issuer:"/O=example.com/OU=example.com_CA/L=New_York/ST=NY/C=US/emailAddress=admin@example.com/CN=example.com_CA"
2020/06/02 00:50:08 [debug] 20166#20166: *3 verify:1, error:0, depth:0, subject:"/C=US/ST=NY/L=New_York/O=example.com/OU=example.com_CA/CN=test.example.net/emailAddress=admin@example.com", issuer:"/C=US/ST=NY/O=example.com/OU=example.com_CA/CN=example.com_CA_INTERMEDIATE/emailAddress=admin@example.com"
2020/06/02 00:50:08 [debug] 20166#20166: *3 ssl new session: 0E2A0672:32:1105
2020/06/02 00:50:08 [debug] 20166#20166: *3 ssl new session: 31C878D7:32:1104
2020/06/02 00:50:08 [debug] 20166#20166: *3 SSL_do_handshake: 1
2020/06/02 00:50:08 [debug] 20166#20166: *3 SSL: TLSv1.3, cipher: "TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD"
2020/06/02 00:50:08 [debug] 20166#20166: *3 reusable connection: 1
2020/06/02 00:50:08 [debug] 20166#20166: *3 http wait request handler
2020/06/02 00:50:08 [debug] 20166#20166: *3 malloc: 0000555967A0B2E0:1024
2020/06/02 00:50:08 [debug] 20166#20166: *3 SSL_read: 772
2020/06/02 00:50:08 [debug] 20166#20166: *3 SSL_read: -1
2020/06/02 00:50:08 [debug] 20166#20166: *3 SSL_get_error: 2
2020/06/02 00:50:08 [debug] 20166#20166: *3 reusable connection: 0
2020/06/02 00:50:08 [debug] 20166#20166: *3 posix_memalign: 00005559678F6460:4096 @16
2020/06/02 00:50:08 [debug] 20166#20166: *3 posix_memalign: 00005559675113A0:4096 @16
2020/06/02 00:50:08 [debug] 20166#20166: *3 http process request line
2020/06/02 00:50:08 [debug] 20166#20166: *3 http request line: "GET /app1 HTTP/1.1"
2020/06/02 00:50:08 [debug] 20166#20166: *3 http uri: "/app1"
2020/06/02 00:50:08 [debug] 20166#20166: *3 http args: ""
2020/06/02 00:50:08 [debug] 20166#20166: *3 http exten: ""
2020/06/02 00:50:08 [debug] 20166#20166: *3 http process request header line
2020/06/02 00:50:08 [info] 20166#20166: *3 client attempted to request the server name different from the one that was negotiated while reading client request headers, client: 127.0.0.1, server: test.example.net, request: "GET /app1 HTTP/1.1", host: "example.net"
2020/06/02 00:50:08 [debug] 20166#20166: *3 http finalize request: 421, "/app1?" a:1, c:1
2020/06/02 00:50:08 [debug] 20166#20166: *3 event timer del: 50: 3334703
2020/06/02 00:50:08 [debug] 20166#20166: *3 http special response: 421, "/app1?"
2020/06/02 00:50:08 [debug] 20166#20166: *3 http set discard body
2020/06/02 00:50:08 [debug] 20166#20166: *3 headers more header filter, uri "/app1"
2020/06/02 00:50:08 [debug] 20166#20166: *3 lua capture header filter, uri "/app1"
2020/06/02 00:50:08 [debug] 20166#20166: *3 xslt filter header
2020/06/02 00:50:08 [debug] 20166#20166: *3 charset: "" > "utf-8"
2020/06/02 00:50:08 [debug] 20166#20166: *3 HTTP/1.1 421 Misdirected Request

noting

2020/06/02 00:50:08 [info] 20166#20166: *3 client attempted to request the server name different from the one that was negotiated while reading client request headers, client: 127.0.0.1, server: test.example.net, request: "GET /app1 HTTP/1.1", host: "example.net"

now, need to stare at this and try to figure out 'why?'
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
Subject Author Posted

proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

PGNet Dev May 29, 2020 10:10PM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

Maxim Dounin June 01, 2020 11:44AM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

PGNet Dev June 02, 2020 12:44AM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

PGNet Dev June 02, 2020 01:00AM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

Sergey Kandaurov June 02, 2020 05:52AM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

Francis Daly June 02, 2020 11:28AM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

PGNet Dev June 02, 2020 03:12PM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

Maxim Dounin June 02, 2020 03:36PM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

PGNet Dev June 02, 2020 04:02PM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

Maxim Dounin June 02, 2020 07:14PM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

Maxim Dounin June 02, 2020 03:22PM

Re: proxy_ssl_verify error: 'upstream SSL certificate does not match "test.example.com" while SSL handshaking to upstream', for CN/SAN 'matched' client & server certs ?

Francis Daly June 04, 2020 11:20AM



Sorry, only registered users may post in this forum.

Click here to login

Online Users

Guests: 284
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready