ERR_BAD_SSL_CLIENT_AUTH_CERT, what it means and how to fix it

Most sites prove their identity to you; a few also demand proof of yours. Government, banking, and corporate systems sometimes require a client certificate, stored on your machine or a smart card, during the TLS handshake. This error means the certificate your browser offered was rejected: expired, issued for a different purpose, not the one the server expects, or impossible to read (a smart card problem is the classic).

The fix, in order

  1. Pick the right certificate when prompted. If several certificates are installed, the browser's chooser may have defaulted to the wrong one. Cancel, reload, and select the certificate issued by the organization that runs the site.
  2. Check the certificate's expiry and purpose. On Windows, certmgr.msc → Personal → Certificates shows your client certificates. The right one must be unexpired and intended for client authentication. An expired certificate must be renewed by its issuer; there is no local workaround.
  3. Reseat the smart card and check its reader. If the certificate lives on a card, remove and reinsert it, confirm the reader's light and driver, and make sure the card's middleware (the vendor's software) is installed and running; Chrome cannot read the card without it.
  4. Try the browser your organization recommends. Some client-certificate systems are tested only against a specific browser and its certificate store. Firefox uses its own store, so a certificate installed in Windows may need importing there separately.
  5. Restart the browser after installing or renewing a certificate. Browsers cache the certificate selection and the store contents at start; a renewal done mid-session is invisible until a restart.

If it still happens

If the correct, unexpired certificate is selected and the server still refuses, the server side has your certificate's record wrong (not yet enrolled, revoked, or mapped to another account). That is fixed by the organization that issued it; bring them the certificate's serial number and the exact error.

Common questions

Why does only this one site ask me for a certificate? Client certificates are an opt-in, high-assurance login method used by organizations that need strong proof of the user or device. Ordinary websites never request one, so the prompt and this error only appear on those specific systems.

Can I skip the client certificate and log in with a password instead? Only if the organization offers that option. Where a client certificate is required, it is the login; there is no browser setting that substitutes a password for it.

Related errors

ERR_SSL_PROTOCOL_ERROR · ERR_CERT_AUTHORITY_INVALID · ERR_BLOCKED_BY_CLIENT