# SSL client certificate not trusted

**URL:** <https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712>\
**Category:** Help!\
**Created:** [September 12, 2020, 3:07pm UTC](https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712 "2020-09-12T15:07:05Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![offbyone](https://avatars.discourse-cdn.com/v4/letter/o/45deac/32.png) [@offbyone](https://discourse.haproxy.org/u/offbyone)\
**Post date:** [September 12, 2020, 3:07pm UTC](https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712/1 "2020-09-12T15:07:05Z")

</div>

I have a rather simple setup where connection fails on the frontend with “SSL client certificate not trusted” and I’m really running out of ideas. I have checked everything multiple times and did not find anything wrong.

Also when using the same certificates on the backend without haproxy involved it works flawlessly. Also when removing “verify required ca-file ca.pem” form the frontend config it works.

Frontend config is quite simple as follows:

```
frontend testFE
mode tcp
option tcplog
bind *:443 ssl crt /etc/haproxy/ssl/crt/server.pem verify required ca-file /etc/haproxy/ssl/ca/ca.pem
default_backend testBE

```

Any suggestions how to track this down any further?

Thanks a lot for your suggestions.

---

<div class="post-metadata">

**Author:** ![offbyone](https://avatars.discourse-cdn.com/v4/letter/o/45deac/32.png) [@offbyone](https://discourse.haproxy.org/u/offbyone)\
**Post date:** [September 12, 2020, 3:17pm UTC](https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712/2 "2020-09-12T15:17:31Z")

</div>

I just tried the following options to further track down the cause of the issue:

ca-ignore-err all  
verify optional

Nothing changed still getting  
“SSL client certificate not trusted”

---

<div class="post-metadata">

**Author:** ![offbyone](https://avatars.discourse-cdn.com/v4/letter/o/45deac/32.png) [@offbyone](https://discourse.haproxy.org/u/offbyone)\
**Post date:** [September 12, 2020, 3:31pm UTC](https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712/3 "2020-09-12T15:31:57Z")

</div>

When adding “crt-ignore-err all” to the config it works, however if I understood this correctly this disables certificate verification altogether. Is this assumption correct?

Maybe anyone has an idea how to get any further from this point.

---

<div class="post-metadata">

**Author:** ![offbyone](https://avatars.discourse-cdn.com/v4/letter/o/45deac/32.png) [@offbyone](https://discourse.haproxy.org/u/offbyone)\
**Post date:** [September 13, 2020, 11:47am UTC](https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712/4 "2020-09-13T11:47:04Z")

</div>

To answer my own question.

I just found the cause of the problem. The client certificate also had some Netscape certificate attributes included. After removing them the client certificate was considered valid by haproxy. The same certificate works flawlessly when used directly with the servers behind haproxy (tomcat). I have not idea why however this doesn’t matter anyway as Netscape certificate attributes are rarely used nowadays,

---

<div class="post-metadata">

**Author:** ![offbyone](https://avatars.discourse-cdn.com/v4/letter/o/45deac/32.png) [@offbyone](https://discourse.haproxy.org/u/offbyone)\
**Post date:** [September 13, 2020, 11:51am UTC](https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712/5 "2020-09-13T11:51:19Z")

</div>

Just a wish.

Maybe it would be possible for haproxy to append the openssl error code to the “SSL client certificate not trusted” error message. This would reduce the time to find the root cause of certificate problems from hours to minutes.

THX

---

<div class="post-metadata">

**Author:** ![pretkjqlhqmmsohuxf](https://avatars.discourse-cdn.com/v4/letter/p/8491ac/32.png) [@pretkjqlhqmmsohuxf](https://discourse.haproxy.org/u/pretkjqlhqmmsohuxf)\
**Post date:** [November 23, 2020, 9:45pm UTC](https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712/6 "2020-11-23T21:45:12Z")

</div>

I got this error after upgrading from 1.8.7 do 2.0.19. In my case, the problem of “SSL client certificate not trusted” was that one of my client certificate was signed using SHA1. After changing to SHA256 I can login.

Probably due to the same problem, when I was using HaProxy 1.8.7 I had to add to “bind” configuration part `crt-ignore-err 4`, (error 4: X509\_V\_ERR\_UNABLE\_TO\_DECRYPT\_CERT\_SIGNATURE). Now I don’t need this part anymore.

I have Netscape extensions (SSL Client, S/MIME) in client certificates and it is working still fine. Perhaps during removing this part, you changed signing method, and this did job.

SSL error messages definitely could be more precise.

---

<div class="post-metadata">

**Author:** ![geneg1](https://avatars.discourse-cdn.com/v4/letter/g/4bbf92/32.png) [@geneg1](https://discourse.haproxy.org/u/geneg1)\
**Post date:** [November 15, 2021, 10:09pm UTC](https://discourse.haproxy.org/t/ssl-client-certificate-not-trusted/5712/7 "2021-11-15T22:09:29Z")

</div>

Re-signing my client cert with SHA256 did the trick for me too. Thanks so much for the tip 🍻