ERR_BAD_SSL_CLIENT_AUTH_CERT
This site identifies you with a certificate installed on your computer. The certificate Chrome offered was expired, wrong, or not accepted by the server.
Quick checks
- Restart Chrome so it asks which certificate to use again.
- Check the certificate hasn't expired.
- Check your date and time.
Fixes on Mac
Check the certificate in Keychain Access
- Open Keychain Access › login › My Certificates and find the certificate the site issued.
- Check its expiry date and that it has a private key (a disclosure triangle under it).
Pick the right one
- Quit Chrome completely (⌘Q) and reopen; when the site asks, choose the correct certificate.
- Delete outdated duplicates from My Certificates to avoid choosing the wrong one.
Fixes on Windows
Check the certificate store
- Run
certmgr.msc› Personal › Certificates; check expiry, then restart Chrome.
- Run
Other devices
Smart cards and tokens
- Make sure the card reader and its software are connected and up to date.
Still not working?
If the certificate is current and still rejected, the issuer may have revoked it or the site changed which authorities it accepts. Contact the organisation that issued it.
See what’s happening
LightAtom's connections view confirms Chrome reaches the site's server, separating a certificate problem from a network one.
Frequently asked questions
What is a client certificate?
A certificate that identifies you, not the server. Some banks, government portals and company networks use it instead of, or as well as, a password.
Why didn't Chrome ask me which certificate to use?
Chrome remembers your choice for the session. Quit Chrome completely and reopen it to be asked again.
Can I export my certificate to another Mac?
Usually, in Keychain Access: right-click › Export, as a .p12 with a password. Some organisations forbid exporting; check their rules.