| Previous | Next |
| HTTP_STATUS_REQUEST_HEADER_TOO_LARGE | HTTP_STATUS_CERTIFICATE_REQUIRED |
HTTP_STATUS_CERTIFICATE_ERROR
It is associated with mutual TLS, where NGINX requested a client certificate and could not verify it. Causes include an untrusted issuing CA, an expired certificate, an incomplete chain, or a certificate not valid for the requested policy.
Check the client certificate chain and the NGINX ssl_client_certificate and verification settings. This is about the client certificate, not the server certificate presented to the client.
Operational meaning of HTTP 495 for HTTP_STATUS_CERTIFICATE_ERROR
HTTP 495 (HTTP_STATUS_CERTIFICATE_ERROR) is a client-error response. AllStat records its meaning as “495 SSL Certificate Error”. For HTTP_STATUS_CERTIFICATE_ERROR, interpret it with the request method, selected representation, response headers, and the specification or product that defines the code; the number alone does not prove that application work completed.
Client and server handling for HTTP_STATUS_CERTIFICATE_ERROR
- Treat HTTP_STATUS_CERTIFICATE_ERROR as a condition visible at the request boundary; inspect authentication, syntax, preconditions, routing, and resource state before retrying.
- For HTTP_STATUS_CERTIFICATE_ERROR, preserve the response body and challenge or retry-related headers because they often carry the actionable reason.
- For HTTP_STATUS_CERTIFICATE_ERROR, automatic retry is safe only when the method and status contract allow it and the request has been corrected.
For telemetry, record HTTP 495, method, authority, route template rather than secrets, response headers relevant to caching or retry, latency, upstream identity, and whether the response originated at the application or an intermediary.
Looking for a different code? Search another status or error code.