Skip to content

495 SSL Certificate Error

Internal nginx code for a client certificate that was provided but failed verification.

Status

HTTP/1.1 495 SSL Certificate Error

Details

  • Category: 4xx
  • Status: Unofficial (nginx). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry only after changing the request

In mutual TLS setups, nginx logs 495 when the client presented a certificate that did not verify: wrong CA, expired, revoked, or malformed. The client usually sees a 400 unless the configuration maps 495 to a custom error page.

It is distinct from 496, which means no certificate was presented at all.

Common causes

  • A client certificate signed by a CA the server does not trust.
  • An expired or revoked client certificate.
  • A certificate chain missing intermediates.

How to fix it

As the client

  • Check the certificate's validity dates and issuing CA against what the server expects.
  • Send the full chain, not just the leaf certificate.
  • Verify with openssl s_client -connect host:443 -cert client.pem -key client.key.

As the server

  • Make sure ssl_client_certificate contains the full trusted CA bundle.
  • Map 495 to an error page that explains the failure rather than a bare 400.

Examples

A client certificate that fails verification

Log

(nginx access log)
495 "GET /secure/api HTTP/1.1" client certificate verify failed

See also