On my NGINX server I'm using the ssl_client_certificate /path/to/clientcert.pem; option to set up a trusted client certificate.
This clientcert.pem file contains two trusted client certificates, the one (A) with the CA certificate of its Issuer, the other (B) one without it. So that's three certificates in total.
When client A makes are request everything works as expected, but when client B makes a request, even though the TLS handshake is successful, NGINX responds with 400 and html message including "The SSL certificate error". The $ssl_client_verify variable holds "FAILED:unable to verify the first certificate".
Is there a way to make NGINX accept the client certificate from B without knowing its Issuer? Or am I misunderstanding the problem here?
Edit: Feedback on @Seifeddine Besbes' comment asking openssl s_client output.
The relevant section is
---
Acceptable client certificate CA names
/C=ZA/ST=MyState/L=MyCity/O=Org/OU=OrgUnit/CN=example.com/emailAddress=CA@example.com
/C=ZA/ST=MyState/L=MyCity/O=Org/OU=OrgUnit/CN=clientA.example.com
/C=ZA/ST=MyState/L=MyCity/O=OtherOrg/OU=OrgUnit/CN=clientB.example.com
Server Temp Key: ECDH, X25519, 253 bits