access_denied
access_denied (49) is sent when a valid certificate was received but access was denied by the server's authorization policy. The certificate is technically valid – it parses, its signature verifies, it is not expired – but the server's policy rejects the connection at the application level.
Alert Code
49
Level
Fatal
Standard
RFC 8446
Description
access_denied differs from certificate rejection alerts – the certificate is cryptographically valid but the server's policy doesn't allow this certificate to connect. This is used in mTLS environments where not all valid client certificates have permission to access the service. The server authenticated the client but the authorization check failed. Can also be sent when client authentication was optional but the presented certificate failed a policy rule.
Common Causes
- –Valid client certificate but client not authorized to access this server
- –Certificate serial number or subject DN not on the allowlist
- –Client certificate used outside its intended time window (access policy)
- –mTLS policy restricts access to specific certificate subjects