Nginx 通过ssl_trusted_certificate正确补全中间证书

# 正确的顺序：服务器证书 → 中间证书1 → 中间证书2（如有）
cat your_domain.crt intermediate.crt > fullchain.crt

server {
    listen 443 ssl http2;
    server_name example.com;
    # 服务器证书 + 中间证书（合并后的完整链）
    ssl_certificate     /etc/nginx/ssl/fullchain.crt;
    ssl_certificate_key /etc/nginx/ssl/private.key;
    # 受信任的 CA 证书（用于验证客户端证书或 OCSP）
    ssl_trusted_certificate /etc/nginx/ssl/chain.pem;
    # OCSP Stapling（需要 ssl_trusted_certificate 支持）
    ssl_stapling on;
    ssl_stapling_verify on;
    # 其他 SSL 配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
}

# 检查证书链是否完整（应显示 0 errors, 0 warnings）
openssl verify -CAfile /etc/nginx/ssl/chain.pem /etc/nginx/ssl/fullchain.crt
# 检查 Nginx 实际提供的证书链
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -text -noout
# 查看完整证书链
echo | openssl s_client -connect example.com:443 -servername example.com -showcerts

# 下载证书商提供的中间证书，合并到 fullchain
cat your_domain.crt ca_intermediate.crt > fullchain.crt

# 从证书中提取并保存中间证书
openssl crl2pkcs7 -nocrl -certfile fullchain.crt | openssl pkcs7 -print_certs -out chain.pem

# ❌ 错误：不要这样合并
cat intermediate.crt your_domain.crt > wrong.crt

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com;
    # 证书配置
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;  # 证书+中间证书
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;      # 私钥
    # 受信 CA 链（用于 OCSP 和客户端验证）
    ssl_trusted_certificate /etc/nginx/ssl/chain.pem;
    # OCSP Stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    # 现代 SSL 配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    # 会话缓存
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
}