---
title: Troubleshooting client certificates · Cloudflare SSL/TLS docs
description: Troubleshoot issues with client certificates
lastUpdated: 2025-08-12T17:54:27.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/ssl/client-certificates/troubleshooting/
  md: https://developers.cloudflare.com/ssl/client-certificates/troubleshooting/index.md
---

If your query returns an error even after configuring and embedding a client SSL certificate, check the following settings.

***

## Check SSL/TLS handshake

On your terminal, use the following command to check whether an SSL/TLS connection can be established successfully between the client and the API endpoint.

```sh
curl --verbose --cert /path/to/certificate.pem --key /path/to/key.pem  https://your-api-endpoint.com
```

If the SSL/TLS handshake cannot be completed, check whether the certificate and the private key are correct.

***

## Check mTLS hosts

Check whether [mTLS has been enabled](https://developers.cloudflare.com/ssl/client-certificates/enable-mtls/) for the correct host. The host should match the API endpoint that you want to protect.

***

## Review mTLS rules

To review mTLS rules:

1. Select **Security** > **WAF** > **Custom rules**.

2. On a specific rule, select **Edit**.

3. On that rule, check whether:

   * The Expression Preview is correct.

   * The hostname, if defined, matches your API endpoint. For example, for the API endpoint `api.trackers.ninja/time`, the rule should look like:

     ```txt
     (http.host in {"api.trackers.ninja"} and not cf.tls_client_auth.cert_verified)
     ```

4. To edit the rule, either use the user interface or select **Edit expression**.
