ERR_BAD_SSL_CLIENT_AUTH_CERT: The client certificate was rejected
Also searched as: net::ERR_BAD_SSL_CLIENT_AUTH_CERT · client certificate rejected · mutual TLS failure
Is ERR_BAD_SSL_CLIENT_AUTH_CERT happening on your domain?
An external handshake shows whether the server is requesting a client certificate at all, which distinguishes a misconfiguration from a missing certificate on your machine.
Free, no signup. Runs from outside your network, which is the only way to tell a server fault from a local one.
Short answer
The server asked for a client certificate during the handshake and rejected the one presented — or none was available. This is mutual TLS, and it fails closed by design.
What ERR_BAD_SSL_CLIENT_AUTH_CERT means
In mutual TLS both sides authenticate. If the client certificate is missing, expired, or not signed by a CA the server trusts, the handshake aborts and the browser shows this error rather than a login page.
Causes and fixes, most likely first
No client certificate is installed for the site that requires one.
Install the issued client certificate into the OS or browser certificate store and restart the browser so it is offered.
The client certificate expired.
Reissue the client certificate. These are usually shorter-lived than server certificates and are a common silent expiry.
Mutual TLS was enabled on a route that should be public.
Scope the client-certificate requirement to the routes that need it instead of the whole hostname.
How to stop it happening again
- •Monitor client certificate expiry with the same discipline as server certificates.
Frequently asked questions
Why does this only happen on one site?
Because only that site requires mutual TLS. Client-certificate requirements are configured per hostname or route.