495 HTTP Origin: Network Last updated 14 Oct 2026

Nginx 400: The SSL certificate error (495 / 496 client certificate)

Nginx rejected the request because the client certificate was invalid (495) or missing (496) on a site that requires mutual TLS.

Exact message you may see The SSL certificate errorNo required SSL certificate was sent495 SSL Certificate Error496 SSL Certificate Requiredclient certificate
Explore the map of this error Full error map →
Seen on: REST API

Meaning

When ssl_verify_client is on, Nginx expects the client to present a certificate signed by the configured CA. Nginx logs 495 (certificate error) or 496 (no certificate) internally but shows the user “400 Bad Request — The SSL certificate error” or “No required SSL certificate was sent”.

Common causes

  • Client didn’t send a certificate (496)
  • Certificate expired, not yet valid, or signed by another CA (495)
  • ssl_client_certificate missing the intermediate CA
  • ssl_verify_depth too low for the chain

⚡ Quick fix

  1. Send the client certificate and key with the request
  2. Check the client cert chain against ssl_client_certificate
  3. Use ssl_verify_client optional for paths that don’t need mTLS

Detailed fix by platform

curl

  1. curl --cert client.crt --key client.key https://api.example.com/

Nginx

  1. nginx
    ssl_client_certificate /etc/nginx/ca-chain.pem;
ssl_verify_client on;
ssl_verify_depth 2;

How to diagnose

  1. Certificate — openssl x509 -in client.crt -noout -dates -issuer
  2. Chain — Is the issuing CA in ssl_client_certificate?
  3. Log — 495 or 496 in access log?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

1013 — Cloudflare Error 1013: HTTP hostname and TLS SNI hostname mismatch (Cloudflare)1013400 — HTTP 400 Bad Request (HTTP)400403 — HTTP 403 Forbidden (HTTP)403403 Forbidden wp-admin — WordPress: 403 Forbidden on wp-admin, wp-login.php or admin-ajax.php (WordPress)403 Forbidden wp-admin404 except homepage — WordPress: 404 Not Found on every page except the homepage (permalinks / .htaccess / Nginx rules) (WordPress)404 except homepage421 — HTTP 421 Misdirected Request (HTTP)421444 — Nginx 444 No Response (connection closed without response) (HTTP)444497 — 400 Bad Request: The plain HTTP request was sent to HTTPS port (Nginx 497) (HTTP)497495

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.