| Previous | Next |
| HTTP_STATUS_REQUEST_HEADER_TOO_LARGE | HTTP_STATUS_CERTIFICATE_REQUIRED |
HTTP_STATUS_CERTIFICATE_ERROR
It is associated with mutual TLS, where NGINX requested a client certificate and could not verify it. Causes include an untrusted issuing CA, an expired certificate, an incomplete chain, or a certificate not valid for the requested policy.
Check the client certificate chain and the NGINX ssl_client_certificate and verification settings. This is about the client certificate, not the server certificate presented to the client.
Check the client-certificate path
When 495 appears in NGINX logging, inspect the client-certificate verification result and the configured trust chain. Common causes include an untrusted issuer, an expired certificate, an invalid chain, or a certificate that does not satisfy the configured verification policy. The client and server TLS logs are more useful than retrying the HTTP request.
Looking for a different code? Search another status or error code.