How to get Nginx to verify MIT personal certificates? - ssl

Question

I run a webapp with users at MIT. They have asked whether the webapp could authenticate users (perhaps as a second factor) by their MIT personal certificates. I have tried but I can't get it to work.
I downloaded the MIT CA certificate from the MIT certificates page – see the link "Get MIT CA (Certificate Authority)" near the bottom of the page – and converted it to PEM format.
Then I uploaded the certificate to the webserver, configured Nginx like this, and reloaded it:
ssl_client_certificate /etc/nginx/certs/mitca.pem;
ssl_verify_client optional;
ssl_verify_depth 2;
When an MIT user visited the webapp, their browser prompted them to choose a certificate. They chose their MIT personal one. Then Nginx showed an error page: "400 Bad Request / The SSL certificate error". The error log contained this:
client SSL certificate verify error: (21:unable to verify the first certificate) while reading client request headers
Error 21 (or X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE) means "No signatures could be verified because the chain contains only one certificate and it is not self signed" according to openssl's docs.
Presumably the "chain" refers to the MIT CA certificate?
I thought the MIT CA certificate was self-signed because of this result:
$ openssl verify -CAfile mitca.pem mitca.pem
mitca.pem: OK
Does anybody know what's wrong?

Answer 1

With nginx, you have to concatenate the certificate chain and the cert into one file, in this case at /etc/nginx/certs/mitca.pem
This can be done on a UNIX CLI with the following command:
cat your-signed.crt ca-cert-chain.crt > /etc/nginx/certs/mitca.pem
...then restart nginx. You can use nginx -t beforehand to make sure that the syntax is OK and the certs are valid (and nginx will restart)