ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED: Fix

• Smart card / eToken locked after a wrong PIN
• Private key corrupted or deleted
• Chrome does not see the client cert in the OS store
• Client cert expired
• Server requires a cert from a specific CA; yours is from a different one
• Outdated smart-card drivers (CryptoPro, JaCarta, Rutoken in RU)

1. Inspect the cert in the OS: Windows — certmgr.msc, macOS — Keychain, Linux — ~/.pki/nssdb
2. Smart card: eject and reinsert, enter PIN carefully
3. Reinstall the certificate from pfx/p12: File → Install Certificate
4. Update smart-card drivers (CryptoPro, JaCarta, Rutoken)
5. Test in Chrome: chrome://settings/certificates — see installed certs
6. Monitor client-cert services with Enterno Monitor

Check SSL Certificate →

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_stapling        on;
    ssl_stapling_verify on;
}

• NET::ERR_CERT_AUTHORITY_INVALID
• ERR_CERT_DATE_INVALID
• ERR_SSL_PROTOCOL_ERROR
• SSL Handshake Failed
• All SSL errors

The error ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED indicates a failure in mutual TLS (mTLS) client authentication due to an invalid or unrecognized client certificate signature. This typically arises from misconfigured certificate authorities, unsupported signature algorithms, or expired certificates. To resolve this, ensure your server is configured to accept the appropriate certificate types and validate client signatures correctly.

The ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED error is an indication that the server could not validate the client certificate presented during the SSL/TLS handshake. This is a common issue in environments that implement mutual TLS (mTLS), where both the client and server authenticate each other using digital certificates.

When a client connects to a server that requires client authentication, the following steps occur:

1. The server requests a certificate from the client.
2. The client sends its certificate to the server.
3. The server attempts to validate the client’s certificate against its trusted Certificate Authorities (CAs).
4. If the signature on the client's certificate cannot be validated, the server responds with the error ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED.

### Common Causes

Several factors can lead to this error:

• Invalid Signature Algorithm: The server may not support the signature algorithm used by the client certificate, such as SHA-1, which is deprecated. Ensure that both client and server support modern algorithms like SHA-256.
• Untrusted Certificate Authority: If the client certificate is issued by a CA that the server does not trust, validation will fail. Check the CA chain and ensure that the server's trust store includes the appropriate root and intermediate certificates.
• Expired or Revoked Certificate: Certificates have a validity period. If the client certificate is expired or has been revoked, the server will reject it. Verify the certificate's validity dates and check for revocation using OCSP or CRL.

### Practical Example: Validating Client Certificates

To troubleshoot the ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED error, you can use the openssl command-line tool to inspect and validate the client certificate. Here’s an example command to check the certificate's signature:

openssl verify -CAfile ca-certificates.crt client-certificate.crt

In this command:

• ca-certificates.crt is the file containing the trusted CA certificates.
• client-certificate.crt is the client certificate you want to validate.

If the output indicates that the certificate is valid, but you still encounter the error, consider checking the server configuration.

### Server Configuration for mTLS

For example, in an Nginx server configuration, you must specify the client certificate verification parameters. Here’s a basic setup:

server {
    listen 443 ssl;
    ssl_certificate server-cert.pem;
    ssl_certificate_key server-key.pem;
    ssl_client_certificate ca-certificates.crt;
    ssl_verify_client on;
}

In this configuration:

• ssl_client_certificate specifies the CA file to validate client certificates.
• ssl_verify_client on enables client certificate verification.

### Conclusion

Addressing the ERR_SSL_CLIENT_AUTH_SIGNATURE_FAILED error requires a systematic approach, focusing on validating certificate signatures, ensuring the correct configuration of trusted CAs, and verifying the validity of client certificates. By leveraging tools like openssl and proper server configurations, you can effectively troubleshoot and resolve this error in your mTLS implementation.