Nginx optional_no_ca requests a certificate without validating its issuer

Nginx's ssl_verify_client directive can be set to on , off , optional , or optional_no_ca . The last value is easy to misread. It requests a client certificate but does not verify the certificate chain against the configured trusted CA. Nginx describes it as intended for deployments where an external service performs the actual verification. If an application treats a presented certificate as proof of identity and Nginx is configured with optional_no_ca , the trust decision has moved somewhere that may not exist.

The certificate can still be useful as an input to another verification step. It should not be accepted merely because the TLS handshake completed. Nginx exposes the verification result through $ssl_client_verify .…