---
title: "ERR_BAD_SSL_CLIENT_AUTH_CERT: causes and how to fix it"
description: "The server asked for a client certificate during the handshake and rejected the one presented — or none was available. This is mutual TLS, and it fails…"
canonical: "https://lemwatch.com/errors/err-bad-ssl-client-auth-cert"
source: "https://lemwatch.com"
---

# ERR_BAD_SSL_CLIENT_AUTH_CERT: The client certificate was rejected

> The server asked for a client certificate during the handshake and rejected the one presented — or none was available. This is mutual TLS, and it fails closed by design.

## Short answer

 The server asked for a client certificate during the handshake and rejected the one presented — or none was available. This is mutual TLS, and it fails closed by design.

## What ERR_BAD_SSL_CLIENT_AUTH_CERT means

 In mutual TLS both sides authenticate. If the client certificate is missing, expired, or not signed by a CA the server trusts, the handshake aborts and the browser shows this error rather than a login page.

## Causes and fixes, most likely first

- No client certificate is installed for the site that requires one. Install the issued client certificate into the OS or browser certificate store and restart the browser so it is offered.
- The client certificate expired. Reissue the client certificate. These are usually shorter-lived than server certificates and are a common silent expiry.
- Mutual TLS was enabled on a route that should be public. Scope the client-certificate requirement to the routes that need it instead of the whole hostname.

## How to stop it happening again

- Monitor client certificate expiry with the same discipline as server certificates.

## Check your own domain

 An external handshake shows whether the server is requesting a client certificate at all, which distinguishes a misconfiguration from a missing certificate on your machine.

## Frequently asked questions

### Why does this only happen on one site?

 Because only that site requires mutual TLS. Client-certificate requirements are configured per hostname or route.


## Related

- [All website error codes](https://lemwatch.com/errors)
- [SSL handshake failed](https://lemwatch.com/errors/ssl-handshake-failed)
- [ERR_SSL_PROTOCOL_ERROR](https://lemwatch.com/errors/err-ssl-protocol-error)
- [HTTP 496](https://lemwatch.com/http-status-codes/496)
- [Free SSL certificate check](https://lemwatch.com/tools/ssl-checker)
- [ERR_BLOCKED_BY_CLIENT: An extension blocked the request](https://lemwatch.com/errors/err-blocked-by-client)
- [ERR_ADDRESS_UNREACHABLE: The IP address cannot be reached](https://lemwatch.com/errors/err-address-unreachable)
- [Website monitoring overview](https://lemwatch.com/website-monitoring)