Consider changing the default value of proxy_ssl_verify_depth
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- C
- Stars
- 31.7k
- Forks
- 8.3k
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 13
Description
Feature Overview
The latest Let's Encrypt certificates utilize two intermediate certificates, which causes the default proxy_ssl_verify_depth 1 to throw an unable to get local issuer certificate error. Is it possible to change this default value?
Alternatives Considered
No response
Additional Context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the implementation and documentation for the proxy_ssl_verify_depth directive, then inspect any related SSL or proxy tests. Confirm the proposed default handles the certificate chain described in the issue without requiring an explicit setting, and update the relevant tests and documentation if the change is accepted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100