SSL 错误：无法验证第一个证书（Nginx -> Spring 引导）

Question

I have a Ubuntu VM and I am attempting to setup an SSL cert from PositiveSSL (looks like they use Comodo) for my domain.

I originally generated mywebsite.csr and mywebsite.key then used a CNAME record on namecheap to verify my SSL cert. Once verified they emailed me mywebsite_com.crt and mywebsite_com.ca-bundle.

I used their instructions at: https://www.namecheap.com/support/knowledgebase/article.aspx/9617/69/how-to-convert-certificates-into-different-formats-using-openssl/ to convert it to.p12 format.

My application.properties looks like:

# The format used for the keystore. It could be set to JKS in case it is a JKS file
server.ssl.key-store-type=PKCS12

# The path to the keystore containing the certificate
server.ssl.key-store=classpath:keystore/mycertificate.p12

# The password used to generate the certificate
server.ssl.key-store-password=redacted

# The alias mapped to the certificate
#server.ssl.key-alias=1

#server.ssl.key-password=redacted

server.ssl.enabled=true

I've tried multiple solutions with setting up a trust store alias, but for now this is my config.

My nginx server config looks like this:

upstream tomcat{
   server localhost:8080;
}

server {  
    listen       443;
    server_name  mywebsite.com;

   ssl on;
   ssl_certificate /root/mywebsite_com.crt;
   ssl_certificate_key /root/mywebsite.key;

    access_log  /var/log/nginx/localhost.access.log  main;

    location / {
            proxy_pass https://tomcat;
            proxy_redirect          off;
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        Host $http_host;
    }
}
}

When I visit https://mywebsite.com it works fine in browser, but when I do a post request from postman it keeps erroring with "SSL Error: Unable to verify the first certificate"

I have a 3rd party webhook posting to my website and it's breaking with the error:

        "success": false,

        "error_class": "RestClient::SSLCertificateNotVerified",

        "error_message": "SSL_connect returned=1 errno=0 state=error: certificate verify failed (unable to get local issuer certificate)",

I've been banging my head against a wall all weekend trying to solve this, I've tried converting to a.pem, a.p7b, making a keystore.jks, combining the bundle and cert into mywebsite_chain.crt. I am at a loss at what to try next, please help.

Answer 1

Finally solved it. Turns out using the cert for nginx and spring boot was causing issues. By disabling ssl on spring boot and changing

proxy_pass https://tomcat;

To:

proxy_pass http://tomcat;

The issue has been resolved.