Cloudflare Nginx SSL Not Trusted/400 bad request (No required ssl certificate was sent)

[jchan237]

I am having trouble setting up Nginx to use my valid SSL certificate.

I have enabled authenticated origin pulls, and toggled it on and off before, and tried both ways, to no avail. My Nginx conf looks like this:

ssl_protocols TLSv1.2 TLSv1.3;

ssl_ciphers EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/dh2048_param.pem;

ssl_session_cache shared:SSL:10m;

ssl_certificate /etc/ssl/certs/vendify-ssl-certificate.pem;
ssl_certificate_key /etc/ssl/private/vendify-ssl-private-key.pem;
ssl_client_certificate /etc/ssl/certs/vendify-CA-CF-Cert.pem;

Now, when I go to the site, the SSL is insecure, because it cannot be verified and trusted.

Then when I add this line to the bottom of the conf file, I get error 400 bad request (No required ssl certificate was sent)

ssl_verify_client on;

Again, I have enabled authenticated origin pulls, so I am not too sure what is going on.

Thanks!

[fritex]

This reminds me a bit on few past topcis

@jchan237

ssl_client_certificate /etc/ssl/certs/vendify-CA-CF-Cert.pem;

May I ask if that is the .pem file from https://developers.cloudflare.com/ssl/static/authenticated_origin_pull_ca.pem?

• Set up authenticated origin pulls · Cloudflare SSL/TLS docs

Are the DNS records proxied at the Cloudflare dashboard?

May I share my posts and from my colleague here:

Authenticated origin pulls with cloudways

May I ask have you allowed only Cloudflare IPs to access your site over considered ports (443 for SSL for example)? In this kind of a setup, I have to admit I never understand which one is the “real worker” here? Nginx or Apache? Therefore, using Nginx, you should save the Authenticated Origin Pull certificate at your host. Next, using Full (Strict) SSL and Cloudflare Origin CA certificate. Port 443 open and Cloudflare IPs allowed. Furthermore, your nginx_site.vhost file should l…

Authenticated Origin Pulls - Handshake failed

I have to admit that I haven’t tested it with an SSL certificate other that Cloudflare Origin CA certificate being generated at Cloudflare dashboard and then installed at my host/origin, while using Authenticated Origin Pulls. What Nginx version are you running and you are running on Ubuntu right? What is the response if you execute the below command (change your origin IP with your real one)?: curl -v --resolve joelteixeira.com:443:[your origin IP] https://joelteixeira.com Also, have you …

Authenticated origin pulls with cloudways

I have only briefly read that document, but it is missing a critical step in enabling Authenticated Origin Pull. They spend a lot of time in the article getting a Cloudflare Origin Certificate enabled, and setting the SSL Mode to Full Strict. Which is great, but has nothing to do with Authenticated Origin Pull. AOP and SSL Mode Full are different things, and are not really related. You can use AOP with a certificate from any CA, like Let’s Encrypt. The missing step is to configure nginx to re…

[jchan237]

I have used another CF Certificate, for the origin_CA_RSA_root.pem available [here](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/#4-required-for-some-add-cloudflare-origin-ca-root-certificates). Since I am using an origin server certificate. I have not proxied my server because this is for a SMTP server that I am hosting, and I am told that SMTP servers should never be proxied.

[jchan237]

Also after running the curl curl -v --resolve joelteixeira.com command, the result is as follows:

[email protected]:/etc/ssl/certs# curl -v --resolve joelteixeira.com:443:[IP] https://joelteixeira.com
* Added joelteixeira.com:443:[IP] to DNS cache
* Hostname joelteixeira.com was found in DNS cache
*   Trying [IP]:443...
* TCP_NODELAY set
* Connected to joelteixeira.com ([IP]) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

[jchan237]

I have also replaced the CA Origin RSA Root Certificate with the origin pull certificate, and temporarily turned on proxy, but still got the same issue

[jchan237]

Just wanted to post one more thing… My ssl certs are not expired, I have openssl v1.1.1f

I have: updated my conf to the ones above, enabled proxying and origin pulls, enabled ssl strict, opened inbound and outbound port 443, and replaced my origin_CA_RSA_root.pem with the Origin pull certificiate. However, it seems like the issue persists…