ssl_trusted_certificate doesn't accept @server_name variable
devCU
nginx-forum at forum.nginx.org
Mon Jun 3 09:42:22 UTC 2019
The following works as advertised in my vhost server block
ssl_certificate /etc/letsencrypt/live/mydomain.com/fullchain.pem;
ssl_certificate_key
/etc/letsencrypt/live/mydomain.com/privkey.pem;
ssl_trusted_certificate
/etc/letsencrypt/live/mydomain.com/chain.pem;
To better automate vhosts en mass I tried using the $server_name variable
server_name mydomain.com;
ssl_certificate /etc/letsencrypt/live/$server_name/fullchain.pem;
ssl_certificate_key
/etc/letsencrypt/live/$server_name/privkey.pem;
ssl_trusted_certificate
/etc/letsencrypt/live/$server_name/chain.pem;
Nginx failed but this works
server_name mydomain.com;
ssl_certificate /etc/letsencrypt/live/$server_name/fullchain.pem;
ssl_certificate_key
/etc/letsencrypt/live/$server_name/privkey.pem;
ssl_trusted_certificate
/etc/letsencrypt/live/mydomain.com/chain.pem;
If ssl_certificate and ssl_certificate accept the $server_name variable then
how come ssl_trusted_certificate doesn't?
Heres the error on Ubuntu 18.04.2 running Nginx 1.17.0 source compiled with
OpenSSL 1.1.1c
Jun 03 05:34:22 cloud systemd[1]: Starting The NGINX HTTP and reverse proxy
server...
Jun 03 05:34:22 cloud nginx[12646]: nginx: [emerg]
SSL_CTX_load_verify_locations("/etc/letsencrypt/live/$server_name/chain.pem")
failed (SSL: error:02001002:system library:
Jun 03 05:34:22 cloud nginx[12646]: nginx: configuration file
/etc/nginx/nginx.conf test failed
Jun 03 05:34:22 cloud systemd[1]: nginx.service: Control process exited,
code=exited status=1
Jun 03 05:34:22 cloud systemd[1]: nginx.service: Failed with result
'exit-code'.
Jun 03 05:34:22 cloud systemd[1]: Failed to start The NGINX HTTP and reverse
proxy server.
ssl_certificate and ssl_certificate_key parse the variable $server_name and
the correct path to the domain's SSL certs are validated.
Seems odd to me. Thanks for any explanation
~Gary
Posted at Nginx Forum: https://forum.nginx.org/read.php?2,284410,284410#msg-284410
More information about the nginx
mailing list