From fba42365c0441e8f43e794143640e53fd16f8b9c Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Sun, 31 Jan 2021 13:03:31 +0300
Subject: [PATCH] fix trusted CAs pem for upstream verify (#2198)

---
 www/nginx/src/opnsense/scripts/nginx/setup.php | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/www/nginx/src/opnsense/scripts/nginx/setup.php b/www/nginx/src/opnsense/scripts/nginx/setup.php
index e0db8c0aa..8623106bd 100755
--- a/www/nginx/src/opnsense/scripts/nginx/setup.php
+++ b/www/nginx/src/opnsense/scripts/nginx/setup.php
@@ -198,16 +198,15 @@ if (isset($nginx['upstream'])) {
             }
             if (!empty($upstream['tls_trusted_certificate'])) {
                 $cas = array();
-                if (is_array($http_server['ca'])) {
-                    foreach ($http_server['ca'] as $caref) {
-                        $ca = find_ca($caref);
-                        if (isset($ca)) {
-                            $cas[] = $ca;
-                        }
-                    }
+                $carefs = explode(",", $upstream['tls_trusted_certificate']);
+                foreach ($carefs as $caref) {
+                   $ca = find_ca($caref);
+                   if (isset($ca)) {
+                       $cas[] = base64_decode($ca['crt']);
+                   }
                 }
                 export_pem_file(
-                    '/usr/local/etc/nginx/key/trust_upstream_' . $upstream_uuid . '.pem',
+                    '/usr/local/etc/nginx/key/trust_upstream_' . $upstream_uuid . '.pem','',
                     implode("\n", $cas)
                 );
             }