From f8ae9286c0e2ee1b10a7d21e857a66ec49205b44 Mon Sep 17 00:00:00 2001
From: alxndrsn <alxndrsn>
Date: Thu, 2 Jul 2026 08:22:39 +0000
Subject: [PATCH] nginx: remove ssl_trusted_certificate

This setting is only relevant if either `ssl_verify_client` or `ssl_stapling` is enabled.  Neither setting is.

Any deployer who does require client certificate verification is likely sophisticated enough to re-enable themselves.

Closes #831
---
 files/nginx/odk.conf.template | 1 -
 1 file changed, 1 deletion(-)

diff --git a/files/nginx/odk.conf.template b/files/nginx/odk.conf.template
index 4a5551c7b..80572588a 100644
--- a/files/nginx/odk.conf.template
+++ b/files/nginx/odk.conf.template
@@ -121,7 +121,6 @@ server {
 
   ssl_certificate /etc/${SSL_TYPE}/live/${CERT_DOMAIN}/fullchain.pem;
   ssl_certificate_key /etc/${SSL_TYPE}/live/${CERT_DOMAIN}/privkey.pem;
-  ssl_trusted_certificate /etc/${SSL_TYPE}/live/${CERT_DOMAIN}/fullchain.pem;
 
   ssl_protocols TLSv1.2 TLSv1.3;
   ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;