Nginx在一段时间后无法validation上游证书

我正在野蛮应用服务器前运行一个nginx代理服务器。两者都通过https通信。 Nginxconfiguration为validation上游证书的签名：

listen 443 ssl http2; server_name _; ssl_certificate_key /etc/nginx/ssl/private/ssl.key.pem; ssl_password_file /etc/nginx/ssl/private/ssl.key.passphrase.txt; proxy_ssl_verify on; proxy_ssl_trusted_certificate /tmp/chain.crt; proxy_ssl_verify_depth 10; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; proxy_buffering off; error_log /proc/self/fd/2; access_log /proc/self/fd/1; # some routes omitted location /orbis-4u/ { proxy_pass https://trrswv056.agfahealthcare.com:8843/orbis-4u/; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Port 443; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; }

所有的作品罚款几个小时/天。经过一段随机的时间后，nginx开始抛出validation错误：

 proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:11 ev:0001 d:00007FEFC638EB60 proxy | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 8718 proxy | 2017/04/03 14:40:12 [debug] 12#12: worker cycle proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13649 proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:17 ev:0004 d:00007FEFC638EA71 proxy | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 2 proxy | 2017/04/03 14:40:12 [debug] 12#12: worker cycle proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13647 proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:17 ev:0005 d:00007FEFC638EA71 proxy | 2017/04/03 14:40:12 [error] 12#12: *2424 upstream SSL certificate verify error: (19:self signed certificate in certificate chain) while SSL handshaking to upstream, client: 172.25.33.10, server: _, request: "GET /orbis-4u/application.wadl HTTP/2.0", upstream: "https://172.25.32.6:8843/orbis-4u/application.wadl", host: "trrsuv042.agfahealthcare.com", referrer: "https://trrsuv042.agfahealthcare.com/auth/realms/orbis/protocol/openid-connect/auth?response_type=code&client_id=orbis-u-webclient&redirect_uri=https%3A%2F%2Ftrrsuv042.agfahealthcare.com%2Forbis-4u%2Fapplication.wadl&state=e6df5055-c90f-44c4-8422-2a108a6241cc&login=true&scope=openid" proxy | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 4 proxy | 2017/04/03 14:40:12 [debug] 12#12: posted event 00007FEFC57314A0 proxy | 2017/04/03 14:40:12 [debug] 12#12: worker cycle proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13643 proxy | 172.25.33.10 - - [03/Apr/2017:14:40:12 +0200] "GET /orbis-4u/application.wadl HTTP/2.0" 502 640 "https://trrsuv042.agfahealthcare.com/auth/realms/orbis/protocol/openid-connect/auth?response_type=code&client_id=orbis-u-webclient&redirect_uri=https%3A%2F%2Ftrrsuv042.agfahealthcare.com%2Forbis-4u%2Fapplication.wadl&state=e6df5055-c90f-44c4-8422-2a108a6241cc&login=true&scope=openid" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36" proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:11 ev:0001 d:00007FEFC638EB60 proxy | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 61 proxy | 2017/04/03 14:40:12 [debug] 12#12: worker cycle proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13582 proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:17 ev:0004 d:00007FEFC638EA70 proxy | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 1 proxy | 2017/04/03 14:40:12 [debug] 12#12: worker cycle proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13581 proxy | 172.25.33.10 - - [03/Apr/2017:14:40:12 +0200] "GET /favicon.ico HTTP/2.0" 502 640 "https://trrsuv042.agfahealthcare.com/orbis-4u/application.wadl" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.116 Safari/537.36" proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll: fd:17 ev:0005 d:00007FEFC638EA70 proxy | 2017/04/03 14:40:12 [error] 12#12: *2424 upstream SSL certificate verify error: (19:self signed certificate in certificate chain) while SSL handshaking to upstream, client: 172.25.33.10, server: _, request: "GET /favicon.ico HTTP/2.0", upstream: "https://172.25.32.6:8843/favicon.ico", host: "trrsuv042.agfahealthcare.com", referrer: "https://trrsuv042.agfahealthcare.com/orbis-4u/application.wadl" proxy | 2017/04/03 14:40:12 [debug] 12#12: timer delta: 4 proxy | 2017/04/03 14:40:12 [debug] 12#12: posted event 00007FEFC57314A0 proxy | 2017/04/03 14:40:12 [debug] 12#12: worker cycle proxy | 2017/04/03 14:40:12 [debug] 12#12: epoll timer: 13577

当我重新启动，它再次正常工作（至less一段时间）。 /tmp/chain.crt文件具有以下内容：

上游返回正确的证书链：

 openssl s_client -connect trrswv056.agfahealthcare.com:8843 CONNECTED(00000003) depth=2 CN = ORBIS-ROOT-CERTIFICATE verify return:1 depth=1 CN = demo verify return:1 depth=0 CN = trrswv056.agfahealthcare.com verify return:1 --- Certificate chain 0 s:/CN=trrswv056.agfahealthcare.com i:/CN=demo 1 s:/CN=demo i:/CN=ORBIS-ROOT-CERTIFICATE 2 s:/CN=ORBIS-ROOT-CERTIFICATE i:/CN=ORBIS-ROOT-CERTIFICATE --- Server certificate -----BEGIN CERTIFICATE----- MIIExDCCAqygAwIBAgICEAUwDQYJKoZIhvcNAQELBQAwDzENMAsGA1UEAwwEZGVt bzAeFw0xNzAzMDcwODI1MTJaFw0yNzAzMDUwODI1MTJaMCcxJTAjBgNVBAMMHHRy cnN3djA1Ni5hZ2ZhaGVhbHRoY2FyZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IB DwAwggEKAoIBAQCwdJ+Ab6yhhkVXNSuX6aI/mMkcPvDo6rslrRJxvCEvmBQOaTVt Cn29xby3B4MEBEDGpLQ8ihbJKnoQUxE50yfbb+XAu1b5T8Zg5Fo3mxQd6lp6otAC 0Ff5pw9wH8TBLkF6iRKMVceremivC4yW9FwSUJIaci2yuld7YFebSOrOVVkbRG+4 +ch6yXV/VVlape0u8wris9+fOsOGYV//Kj4BHw5iDCFO9bIefESsWj0eNxD/SYNP dnwFmk88ITCI3BXneG/Sz7g0RxWui+dzhhYtOIA/FMcLnkTJDmV988WqRSHVsBZS 1vGfNuyceDZc1hFQLZOghGvP6TySf9oZwqUxAgMBAAGjggEQMIIBDDAJBgNVHRME AjAAMBEGCWCGSAGG+EIBAQQEAwIGQDAzBglghkgBhvhCAQ0EJhYkT3BlblNTTCBH ZW5lcmF0ZWQgU2VydmVyIENlcnRpZmljYXRlMB0GA1UdDgQWBBQ9Yxm91o8zsMY5 aasQpIL61zGPVTBKBgNVHSMEQzBBgBQDxGBBTFAr9ji0cw46imHmY3GLMaElpCMw ITEfMB0GA1UEAwwWT1JCSVMtUk9PVC1DRVJUSUZJQ0FURYICEAUwDgYDVR0PAQH/ BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMCcGA1UdEQQgMB6CHHRycnN3djA1 Ni5hZ2ZhaGVhbHRoY2FyZS5jb20wDQYJKoZIhvcNAQELBQADggIBAMEVQ/3clniF 8J0KV51iEifmCruntHDudRaam3Mr7CqOo1+1kG6pH6ECMg1nMICrO/LJnscXbN4h xDDWPEIEnWh0frQtmua4NABlAYQXY41JVBcajb0lvcGygop/kw4nxLSgySjd1jtZ 5MFCLo2BLg/Wqfn64gvoF4oF63eC1Cfi9PxqrDqdI6Dp/UqChhB1Q60cZC4rVjwM o0uUW3X+g/Yy9ssA4X65d9KaJQSXBhTZO2yRKVZrjEEx3uSz49Touw/t6uRRl1o8 oAsO/RcN/uZvRdP/9lXRcnBERxldVzWFOxv6QUwNbHIUwQmX4kg65W5MteKikp+q eX0YmB0HRKlNQHVoS/MqAufnMGX/ujIz+2WJFif0VsG1j5GoXJgPwMEwRLZNCjLG 0SWMTMO56WRp1Me2KBCsohmNPC81Fr/xSfW86SOh1XaxQJmiBh/jOjLMVcFIXjk2 yPvvjPjMqcC5NHyQ6NGStf4fYliBHTWrp3mLdStvElfMjrVzC5ykCEmrEFoGYPKo SiGJ2JyczNVgc0P/gPhWgFcUCM4f6o3yM+/BEM3Fnb4ZzaepYmj2DolVnPGE1POq al+kcmzru1eh3AHz+fqt+ZKdrvaXW0Tzv6SNwDqmAh2xgfUVROI3yq1KdtzkcuRE mEccxp95Zuath6FrCf31xPUo5GXxwVQl -----END CERTIFICATE----- subject=/CN=trrswv056.agfahealthcare.com issuer=/CN=demo --- No client certificate CA names sent Peer signing digest: SHA512 Server Temp Key: ECDH, P-256, 256 bits --- SSL handshake has read 4337 bytes and written 433 bytes --- New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES128-GCM-SHA256 Session-ID: 58E249C1A8D2311CDD1CE823EBD07E7E80855A7D40298581CFB0802503C868E3 Session-ID-ctx: Master-Key: 7A3D1E88CC714B23EE93830B69534E3AA70BDBD2FB4FA6AC38D18622DC569CCF3993934352DE509F21A77A8CD7775BAB Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1491225025 Timeout : 300 (sec) Verify return code: 0 (ok) ---

Nginx的版本是1.11.10，在一个Docker容器（Alpine linux）中运行。

我的问题是：

为什么nginx在一段时间后无法validation我的证书？
有没有办法来debugging呢？我已经打开debugging日志，你可以看到…但它并没有真正的帮助。