495 SSL Certificate Error
Internal nginx code for a client certificate that was provided but failed verification.
Status
HTTP/1.1 495 SSL Certificate Error
Details
- Category: 4xx
- Status: Unofficial (nginx). Not registered with IANA. A server, framework, or CDN convention.
- Specification: none, not defined by any RFC
- Cacheable: Not cacheable
- Response body: Allowed
- Retry: Retry only after changing the request
In mutual TLS setups, nginx logs 495 when the client presented a certificate that did not verify: wrong CA, expired, revoked, or malformed. The client usually sees a 400 unless the configuration maps 495 to a custom error page.
It is distinct from 496, which means no certificate was presented at all.
Common causes
- A client certificate signed by a CA the server does not trust.
- An expired or revoked client certificate.
- A certificate chain missing intermediates.
How to fix it
As the client
- Check the certificate's validity dates and issuing CA against what the server expects.
- Send the full chain, not just the leaf certificate.
- Verify with openssl s_client -connect host:443 -cert client.pem -key client.key.
As the server
- Make sure ssl_client_certificate contains the full trusted CA bundle.
- Map 495 to an error page that explains the failure rather than a bare 400.
Examples
A client certificate that fails verification
Log
(nginx access log) 495 "GET /secure/api HTTP/1.1" client certificate verify failed