495 SSL Certificate Error

nginx internal: the client certificate failed verification; the client receives 400.

495 at a glance

Code: 495
Name: SSL Certificate Error
Class: 4xx Client error
Status: Non-standard used by nginx
Documented by: nginx
Client receives: A 400 Bad Request page; 495 appears only in nginx logs and error_page.
Cacheable by default: Not applicable: this code is never sent to the client.

What 495 means

With mutual TLS (ssl_verify_client on), nginx uses 495 when the client presented a certificate that fails verification (untrusted issuer, expired, revoked). The client receives 400 with "The SSL certificate error"; the separate code lets you define error_page 495.

What typically causes a 495

Client certificate signed by a CA not in ssl_client_certificate / ssl_trusted_certificate.
Expired or revoked client certificate (CRL via ssl_crl).
Certificate chain deeper than ssl_verify_depth.

Fix it on the server

Check $ssl_client_verify in logs: it contains the reason, e.g. "FAILED:certificate has expired".

Fix it as a client or visitor

Use a current certificate issued by the CA the server trusts, and send the full chain.

Example response

HTTP/1.1 400 Bad Request
Server: nginx
Content-Type: text/html

<center>The SSL certificate error</center>