I am wondering what does ssl_verify_depth mean in nginx.conf? The docs are not very detailed, there is just this sentece:
Sets the verification depth in the client certificates chain.
What does increasing or decreasing do? I've noticed that increasing it makes nginx more likely to accept the cert, but why is that?
The depth actually is the maximum number of intermediate certificate issuers, i.e. the number of CA certificates which are max allowed to be followed while verifying the client certificate.
A depth of 0 means that self-signed client certificates are accepted only, the default depth of 1 means the client certificate can be self-signed or has to be signed by a CA which is directly known to the server (i.e. the CA's certificate is under SSLCACertificatePath), etc. A depth of 2 means that certificates signed by a (single level of) intermediate CA are accepted i.e. by an intermediate CA, whose CA certificate is signed by a CA directly known to the server.
Our perl test about this directive has some very useful comments and will help you to understand my explanation in a NGINX Context a little bit better.
