after hours or research, I finally give up on this issue and need help. I configured my Nginx server to handle client authentication through certificate, that was simple:

First, I used this tutorial to generate my client and server .crt https://fardog.io/blog/2017/12/30/client-side-certificate-authentication-with-nginx/

Then, I added these lines into my configuration;

ssl_client_certificate /etc/nginx/ssl/myCA.crt;
ssl_verify_client on;

Finally, I installed the .pfx on my workstation, ran Internet explorer and browsed my website. IE asked me for the certificate and it worked fine!

After that, I decided to go with a real certificate, issued by a trusted company for obvious reasons. It's a digicert sha2 secure server ca by the way.

This time I converted the .pfx into .crt and .key, I uploaded the .crt into my Nginx server to replace myCa.crt then I added the pfx to my workstation.

Unfortunately, this time IE didn't want to prompt me for a certificate. I tried using Postman and I got this message (after adding the pfx into the settings/Certificates): 21:unable to verify the first certificate

My question is, what is the difference between my trusted certificate and my self-generated? I can't figure out why this isn't working and I have no other error message to rely on.

For sure, I use the same trusted cert for both the client and the server, however I tried the same thing using my sefl-generated and it worked.

I have no clues...

Thank you in advance.

  • Can you run openssl x509 -text < your_digicert_certificate.crt and report what's shown under "X509v3 Extended Key Usage"? – user1686 May 9 '19 at 5:22
  • Hi @grawity , running it I got this, which sounds good: TLS Web Server Authentication, TLS Web Client Authentication I asked the provider, Digicert, and they told me that the intermediate certificate should be missing. But I don't know why/where it should be, within the crt file on within the trusted repository on both server/client.. – Akidd May 9 '19 at 13:20

OK, so after a long troubleshooting session I found out I have to add the Global root certificate into the trusted CA store of my Ubuntu server, and add all the chain certificate in the server side .crt file.

Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.