SSL Certificate Error
ActiveHTTP 495 SSL Certificate Error is an Nginx-proprietary status code returned when the client provides an invalid SSL/TLS certificate during mutual TLS (mTLS) authentication. The certificate failed verification – it may be expired, self-signed without a trusted CA, or have a signature error. Nginx returns 495 instead of 400 to allow specific error handling for mTLS failures.
Description
495 occurs in nginx configurations that require client certificate authentication (ssl_verify_client on or optional). When the client presents a certificate that fails verification, nginx returns 495. This allows error_page 495 directives to redirect to a specific error page or return a custom JSON error response. The standard equivalent would be 400 Bad Request, but 495 provides a more specific signal for certificate-related failures.
Examples
server {
ssl_verify_client optional;
error_page 495 = /ssl-error;
# 495 fires when client cert is invalid
}Edge Cases
- •495 is Nginx-specific. Apache and other servers handle mTLS errors differently.
- •ssl_verify_client optional_no_ca suppresses certificate verification entirely.
When You'll See This
- →Client presents expired certificate in mTLS handshake
- →Self-signed client certificate not trusted by nginx CA list
- →Client certificate signature verification fails
Implementation References
| Language | Constant |
|---|---|
| Nginx | 495 (NGX_HTTP_TO_HTTPS) |
| Go | 495 (no standard constant) |
History
Introduced by Nginx to distinguish client certificate errors from other bad request conditions in mTLS configurations.
Related Status Codes
Related Headers
FAQ
What is the difference between 495 and 496?
495 means the client provided a certificate but it was invalid (failed verification). 496 means the server required a certificate but the client did not provide one.