495 SSL Certificate Error

Failed client certificate verification on nginx produces the 495 SSL Certificate Error status code.

Table of Contents

Usage

The 495 SSL Certificate Error status code indicates the client sent an invalid SSL certificate with the HTTP request. Resolving this error requires resubmitting the request with a valid client certificate.

Common causes include expired certificates, certificates signed by an untrusted authority, and certificates with mismatched common names.

Example

A client sends a request with an expired client certificate. The nginx server records the failure as 495 SSL Certificate Error and, in the default configuration, answers the client with a 400 response carrying the built-in error page.

Request

GET /secure/api HTTP/1.1
Host: www.example.re

Response

HTTP/1.1 400 Bad Request
Server: nginx
Content-Type: text/html
Connection: close

<html>
<head><title>400 The SSL certificate error</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>The SSL certificate error</center>
<hr><center>nginx</center>
</body>
</html>

The nginx error log records the specific certificate verification failure:

client SSL certificate verify error:
(10:certificate has expired)

Configuring client certificate verification

The ssl_verify_client directive decides whether 495 arises at all, and the mode chosen changes which failures surface.

Mode Behavior
off No verification, default
on Certificate required and verified
optional Verified when presented
optional_no_ca Verified without requiring a known CA

Verification failures under on and optional both produce 495. Selecting optional_no_ca accepts certificates whose chain leads nowhere trusted, which suits deployments passing the certificate to an application for its own checks.

ssl_client_certificate /etc/nginx/ssl/client-ca.crt;
ssl_verify_client on;
ssl_verify_depth 2;

The ssl_verify_depth directive defaults to 1, so a certificate signed through an intermediate rather than directly by the trusted root fails verification until the depth rises.

The handshake itself completes before any of this happens. nginx accepts the connection, then checks the verification result while processing the request, which is why a certificate problem produces an HTTP status rather than a TLS alert. Client-side symptoms therefore look like a normal 400 response rather than a failed connection.

error_page 495 =400 /errors/cert-invalid.html;

location = /errors/cert-invalid.html {
    root /var/www;
    internal;
}

The directive belongs at server or http level, since no location is selected when the condition arises.

How to fix

Check the nginx error log first. The log entry identifies the exact verification failure with a numeric code:

client SSL certificate verify error:
(10:certificate has expired)
(2:unable to get issuer certificate)
(21:unable to verify the first certificate)

Verify the client certificate is not expired. Check the certificate dates with:

openssl x509 -enddate -noout -in client.pem

Renew the certificate before expiry to avoid service interruptions.

Ensure the full certificate chain is included. Intermediate certificates linking the client certificate to a trusted root must be bundled in the client request. Missing intermediates produce error code 2 or 21 in the nginx log.

Confirm the issuing CA is listed in the server's ssl_client_certificate file. This file must contain all trusted CA certificates (root and intermediate) in PEM format, concatenated:

ssl_client_certificate /etc/nginx/trusted_ca.pem;
ssl_verify_client on;
ssl_verify_depth 3;

The ssl_verify_depth directive controls how many intermediate certificates nginx traverses when building the chain. The default is 1, which is insufficient for chains with multiple intermediates.

Check key strength. Certificates with keys shorter than 2048 bits fail verification on systems enforcing modern security policies.

Increase the nginx error log verbosity to info level when debugging:

error_log /var/log/nginx/error.log info;

Use error_page 495 to serve a custom error page instead of the default nginx error:

error_page 495 /cert_error.html;

Regenerate the client certificate if the private key is compromised or the certificate file is corrupted.

See also

Last updated: August 17, 2026