495 SSL Certificate Error

Internal nginx code for a client certificate that was provided but failed verification.

Status

HTTP/1.1 495 SSL Certificate Error

Details

Category: 4xx
Status: Unofficial (nginx). Not registered with IANA. A server, framework, or CDN convention.
Specification: none, not defined by any RFC
Cacheable: Not cacheable
Response body: Allowed
Retry: Retry only after changing the request

In mutual TLS setups, nginx logs 495 when the client presented a certificate that did not verify: wrong CA, expired, revoked, or malformed. The client usually sees a 400 unless the configuration maps 495 to a custom error page.

It is distinct from 496, which means no certificate was presented at all.

Common causes

A client certificate signed by a CA the server does not trust.
An expired or revoked client certificate.
A certificate chain missing intermediates.

How to fix it

As the client

Check the certificate's validity dates and issuing CA against what the server expects.
Send the full chain, not just the leaf certificate.
Verify with openssl s_client -connect host:443 -cert client.pem -key client.key.

As the server

Make sure ssl_client_certificate contains the full trusted CA bundle.
Map 495 to an error page that explains the failure rather than a bare 400.

Examples

(nginx access log)
495 "GET /secure/api HTTP/1.1" client certificate verify failed