ERR_BAD_SSL_CLIENT_AUTH_CERT in Chrome means mutual TLS (client certificate) auth failed. The SSL2Buy wiki lists common causes: expired client cert, broken chain, wrong format, browser cache, date/time issues, or server config. The team that walks through this checklist resolves the issue in minutes.
Table of contents
- What client cert auth is
- Cause 1: expired client cert
- Cause 2: broken certificate chain
- Cause 3: wrong format
- Cause 4: browser cache
- Cause 5: date/time issues
- Cause 6: server-side config
- Debugging with Chrome
- FAQ
What client cert auth is
Mutual TLS (mTLS) requires the client to present a certificate:
- Server presents its cert (normal TLS).
- Client presents its cert (mutual TLS).
- Server verifies client cert against its trust store.
Used for: API authentication, zero-trust networks, internal services. The team that uses mTLS has stronger auth than password/token.
Cause 1: expired client cert
Check the cert:
openssl x509 -in client.p12 -noout -datesThe team that sees notAfter in the past has an expired cert. Renew through your PKI or CA.
Cause 2: broken certificate chain
The client cert is signed by an intermediate that the server doesn’t trust:
# Check the chain
openssl s_client -connect example.com:443 -cert client.pem -key client.key -showcertsThe team that has missing intermediate certs has chain issues. Fix: include full chain in the .p12 or .pfx.
Cause 3: wrong format
Chrome expects PKCS#12 (.p12/.pfx) for client certs:
# Convert from PEM to PKCS#12
openssl pkcs12 -export -in client.pem -inkey client.key -out client.p12 -name 'my-client-cert'Import the .p12 into Chrome’s cert store.
Cause 4: browser cache
Chrome caches cert decisions. The team that fixes the cert and Chrome still rejects has stale cache. Fix: clear browser cache + certs, restart Chrome.
Cause 5: date/time issues
Cert validity is checked against system clock. The team that has wrong date/time has cert validity failures. Fix: enable NTP sync.
Cause 6: server-side config
The server’s TLS config doesn’t request client cert, or the CA isn’t trusted. Check the server:
# nginx
ssl_client_certificate /etc/ssl/client-ca.crt;
ssl_verify_client on;The team that has client cert auth misconfigured on the server has the error.
Debugging with Chrome
Chrome’s certificate viewer (Settings > Privacy and Security > Security > Manage Certificates) shows installed client certs. The team that uses this has visibility into what Chrome has loaded.
FAQ
What is ERR_BAD_SSL_CLIENT_AUTH_CERT?
Chrome error meaning the client certificate was rejected by the server during mutual TLS handshake.
How do I import a client cert into Chrome?
Settings > Privacy and Security > Security > Manage Certificates > Import. Select the .p12 file, enter the password.
Why does mTLS fail on some browsers but not others?
Different cert stores, different supported algorithms, different default cert selection. The team that uses Chrome for testing has one set of behavior; Firefox may differ.
Can I use mTLS for API authentication?
Yes - common pattern. The API gateway validates client certs, app code uses the cert’s CN/SAN for identity.
How do I test mTLS locally?
Generate self-signed client cert, configure server to trust it. Use openssl s_client to test. The team that has local mTLS testing has confidence before prod.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: