I come from a DEV background, but trying to improve my sec/ops skills to become more versatile.

I've set up my own local certificate authority following this guide (albeit fairly loosely).

I successfully created a root pair (key & cert), an intermediate pair, and a server pair for test.mydomain.com.

I then configured nginx as a service proxy to an Node.js web API (served by Express FWIW). Both nginx and the nodejs service are containerised and I'm just using docker-compose to run this locally. I've also added a hosts entry so that I can access my service using test.mydomain.com. Eventually I want to implement the service-proxy/sidecar pattern in Kubernetes (where nginx and the (micro)service run in the same pod), but for now I'm just trying to get it working in docker.

It was all working over HTTP, so the next step is to get it working for HTTPS (where TLS terminates at the nginx service-proxy and the request then gets proxied to the Node.js service over HTTP). It is working, but I can't get my browser (Chrome running in Windows) to accept my certificate.

I've tried a few combinations of importing certificates into Windows certificate stores including:

• importing the root certificate into the trusted root CAs certificate store
• importing the intermediate certificate into the intermediate CAs certificate store
• chaining the root and intermediate certs and importing to the root CAs certificate store

but I can't get Chrome to accept my certificate.

FYI nginx is configured as follows

ssl_certificate /etc/ssl/test.mydomain.com.cert.pem;
ssl_certificate_key /etc/ssl/private/test.mydomain.com.key.pem;

Should I be chaining the server, intermediate, & root certs for the ssl_certificate setting in nginx?.. and what certificate (or chained certificate) should I be importing to which certificate store?

I also noticed there's a ssl_trusted_certificate nginx setting, which I'm not sure if I should be using...

Cheers, Ryan.