# $ssl\_client\_verify not working? **URL:** \ **Category:** NGINX\ **Created:** [April 13, 2016, 2:02am UTC](https://www.ruby-forum.com/t/ssl-client-verify-not-working/244452 "2016-04-13T02:02:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\ **Post date:** [April 13, 2016, 2:02am UTC](https://www.ruby-forum.com/t/ssl-client-verify-not-working/244452/1 "2016-04-13T02:02:42Z")
Hi, i was wanting to return a 403 when invalid client certificate submitted, however Nginx 1.9.6 returning 400 Bad Request, The SSL Certificate Error. Seems to return 403 fine when no certificate is submitted, but any clues on getting it to return a 403 work when invalid (signed by unauthorised CA) certificate submitted. Nginx server block - ``` server { listen 443 ssl; server_name server.com; ssl_certificate /etc/nginx/server.crt; ssl_certificate_key /etc/nginx/server.key; ssl_client_certificate /etc/nginx/client_ca.crt; ssl_verify_client optional; ssl_verify_depth 2; if ($ssl_client_verify != SUCCESS ) { return 403; } ``` Posted at Nginx Forum: > **[$ssl\_client\_verify not working?](https://forum.nginx.org/read.php?2,266136,266136#msg-266136)** > > Hi, i was wanting to return a 403 when invalid client certificate submitted, however Nginx 1.9.6 returning 400 Bad Request, The SSL Certificate Error. Seems to return 403 fine when no certificate is submitted, but any clues on getting it to return a... ---
**Author:** ![Ramon\_Ali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3d9bf3/32.png) [@Ramon\_Ali](https://www.ruby-forum.com/u/Ramon_Ali)\ **Post date:** [April 13, 2016, 8:32am UTC](https://www.ruby-forum.com/t/ssl-client-verify-not-working/244452/2 "2016-04-13T08:32:55Z")
… i also tried adding below, but still wouldn’t return a 403? ``` error_page 400 =403 /; ``` Posted at Nginx Forum: > **[Re: $ssl\_client\_verify not working?](https://forum.nginx.org/read.php?2,266136,266138#msg-266138)** > > Hi, i was wanting to return a 403 when invalid client certificate submitted, however Nginx 1.9.6 returning 400 Bad Request, The SSL Certificate Error. Seems to return 403 fine when no certificate is submitted, but any clues on getting it to return a... ---
**Author:** ![Ramon\_Ali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3d9bf3/32.png) [@Ramon\_Ali](https://www.ruby-forum.com/u/Ramon_Ali)\ **Post date:** [April 14, 2016, 7:38pm UTC](https://www.ruby-forum.com/t/ssl-client-verify-not-working/244452/3 "2016-04-14T19:38:15Z")
Does anyone know of any way to re-map a 400 response code? Posted at Nginx Forum: > **[Re: $ssl\_client\_verify not working?](https://forum.nginx.org/read.php?2,266136,266185#msg-266185)** > > Hi, i was wanting to return a 403 when invalid client certificate submitted, however Nginx 1.9.6 returning 400 Bad Request, The SSL Certificate Error. Seems to return 403 fine when no certificate is submitted, but any clues on getting it to return a... ---
**Author:** ![Ramon\_Ali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3d9bf3/32.png) [@Ramon\_Ali](https://www.ruby-forum.com/u/Ramon_Ali)\ **Post date:** [April 14, 2016, 9:09pm UTC](https://www.ruby-forum.com/t/ssl-client-verify-not-working/244452/4 "2016-04-14T21:09:58Z")
On 13 Apr 2016, at 03:01, Ramon\_Ali [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > ``` > server_name server.com; > } > > ``` > **[Module ngx\_http\_ssl\_module](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#errors)** > > The ngx\_http\_ssl\_module module provides the necessary support for HTTPS. error\_page 495 496 =403 /403.html; – Igor S. > **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)** > > Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises. ---
**Author:** ![Ramon\_Ali](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3d9bf3/32.png) [@Ramon\_Ali](https://www.ruby-forum.com/u/Ramon_Ali)\ **Post date:** [April 14, 2016, 11:52pm UTC](https://www.ruby-forum.com/t/ssl-client-verify-not-working/244452/5 "2016-04-14T23:52:58Z")
Ahh, as i wasn’t seeing the 495 and 496 codes in the logs, only 400 i had assumed that what i needed to re-map. Using 495 and 496 works wonderfully! Thanks Igor. 2016/04/14 21:46:51 [info] 7#7: \*1 client SSL certificate verify error: (21:unable to verify the first certificate) while reading client request headers, client: 142.22.213.199, server: [server.jetstar.com](http://server.jetstar.com), request: “GET / HTTP/1.1”, host: “[server.com](http://server.com)” 172.23.203.199 - - [14/Apr/2016:21:46:51 +0000] “GET / HTTP/1.1” 403 168 “-” “curl/7.40.0” “-”“/C=AU/ST=NSW/L=Sydney/O=ex NSI/OU=HQ/CN=Ramon’s Key/emailAddress=removed\_email\_address@domain.invalid” “/C=AU/ST=NSW/O=NSI/OU=HQ/CN=Cert Authority/emailAddress=removed\_email\_address@domain.invalid”;“FAILED” Posted at Nginx Forum: > **[Re: $ssl\_client\_verify not working?](https://forum.nginx.org/read.php?2,266136,266191#msg-266191)** > > Hi, i was wanting to return a 403 when invalid client certificate submitted, however Nginx 1.9.6 returning 400 Bad Request, The SSL Certificate Error. Seems to return 403 fine when no certificate is submitted, but any clues on getting it to return a...