495 SSL Certificate Error

Failed client certificate verification on nginx produces the 495 SSL Certificate Error status code.

Table of Contents

Usage

The 495 SSL Certificate Error status code indicates the client sent an invalid SSL certificate with the HTTP request. Resolving this error requires resubmitting the request with a valid client certificate.

Common causes include expired certificates, certificates signed by an untrusted authority, and certificates with mismatched common names.

Note

495 is an nginx-internal status code. nginx logs the error as 495 internally but returns 400 to the client with the body "The SSL certificate error" unless error_page 495 is configured to map the code to a different response.

SEO impact

Search engines like Google do not index a URL with 495 SSL Certificate Error response status. URLs previously indexed with this code are removed from search results.

Example

A client sends a request with an expired client certificate. The nginx server records the failure as 495 SSL Certificate Error and, in the default configuration, answers the client with a 400 response carrying the built-in error page.

Request

GET /secure/api HTTP/1.1
Host: www.example.re

Response

HTTP/1.1 400 Bad Request
Server: nginx
Content-Type: text/html
Connection: close

<html>
<head><title>400 The SSL certificate error</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>The SSL certificate error</center>
<hr><center>nginx</center>
</body>
</html>

The nginx error log records the specific certificate verification failure:

SSL client certificate verify error:
(10:certificate has expired)

How to fix

Check the nginx error log first. The log entry identifies the exact verification failure with a numeric code:

SSL client certificate verify error:
(10:certificate has expired)
(2:unable to get issuer certificate)
(21:unable to verify the first certificate)

Verify the client certificate is not expired. Check the certificate dates with:

openssl x509 -enddate -noout -in client.pem

Renew the certificate before expiry to avoid service interruptions.

Ensure the full certificate chain is included. Intermediate certificates linking the client certificate to a trusted root must be bundled in the client request. Missing intermediates produce error code 2 or 21 in the nginx log.

Confirm the issuing CA is listed in the server's ssl_client_certificate file. This file must contain all trusted CA certificates (root and intermediate) in PEM format, concatenated:

ssl_client_certificate /etc/nginx/trusted_ca.pem;
ssl_verify_client on;
ssl_verify_depth 3;

The ssl_verify_depth directive controls how many intermediate certificates nginx traverses when building the chain. The default is 1, which is insufficient for chains with multiple intermediates.

Check key strength. Certificates with keys shorter than 2048 bits fail verification on systems enforcing modern security policies.

Increase the nginx error log verbosity to info level when debugging:

error_log /var/log/nginx/error.log info;

Use error_page 495 to serve a custom error page instead of the default nginx error:

error_page 495 /cert_error.html;

Regenerate the client certificate if the private key is compromised or the certificate file is corrupted.

See also

Last updated: August 11, 2026