3:unable to get certificate CRL

[Janet Valbuena]

Hi Nginx Team

I'm having problems configuring NGINX to use a CRL.

I've created the CRL using OpenSSL 0.9.8e and my Nginx version is 1.4.1.

I'm using a self-signed certificate and an intermediate certificate.

The lines for the SSL in my config are:

server {
>     listen       10446 ssl;
>
>     ssl_session_cache   shared:SSL:10m;
>     ssl_session_timeout 10m;
>     ssl_prefer_server_ciphers on;
>
>     ssl_certificate /etc/nginx/ssl/star_net.crt;
>     ssl_certificate_key /etc/nginx/ssl/star_net.key;
>
>     ssl_client_certificate /etc/certs/ca-chain.cert.pem;
>
>     ssl_crl /etc/certs/crl.cert.pem;
>
>     ssl_verify_client on;
>     ssl_verify_depth 2;
>
>
If I comment the ssl_crl line, I don't get any errors.

However as soon as I uncomment it I get this error:

..... client SSL certificate verify error: (3:unable to get certificate
> CRL) while reading client request headers, client: ....
>

I can't see what is wrong in my config. Help please.

Thanks very much

Janet
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20150312/a780127e/attachment.html>