Specifcally, when configuring nginx to validate proxy target SSL certificates (which it mystifyingly does not do by default), a maximum cert chain depth must be specified in the proxy_ssl_verify_depth option. If I am writing a configuration to be used in environments in which I do not control how deep the cert chain may be, is there a reason for this to have any particular limit, or should it just be a high number? I haven't encountered any other TLS client that even exposes this as configurable, let alone has the default value of 1 (no intermediate CAs) that nginx does. So I'm thinking it should just be a high number to avoid running into it unnecessarily, but not sure if I'm missing something.


I think this is DoS prevention: building the chain might be an exponential algorithm with backoff, so with the openssl default of 100 a malicious backend might cause denial of service in nginx. I would use 10. In practice, 4 should be enough.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.