# Client SSL certificate verify error: (3:unable to get certificate CRL) while reading client request headers

**URL:** <https://community.nginx.org/t/client-ssl-certificate-verify-error-3-unable-to-get-certificate-crl-while-reading-client-request-headers/2157>\
**Category:** NGINX\
**Tags:** ssl, openssl\
**Created:** [April 15, 2025, 3:33am UTC](https://community.nginx.org/t/client-ssl-certificate-verify-error-3-unable-to-get-certificate-crl-while-reading-client-request-headers/2157 "2025-04-15T03:33:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![yang](https://avatars.discourse-cdn.com/v4/letter/y/77aa72/32.png) [@yang](https://community.nginx.org/u/yang)\
**Post date:** [April 15, 2025, 3:33am UTC](https://community.nginx.org/t/client-ssl-certificate-verify-error-3-unable-to-get-certificate-crl-while-reading-client-request-headers/2157/1 "2025-04-15T03:33:06Z")

</div>

**My issue** :  
I want to use ssl\_crl to verify the client certificate’s revocation status， but it didn’t work fine for me, while the browser shows “The SSL certificate error”, and the nginx’s error.log shows “client SSL certificate verify error: (3:unable to get certificate CRL) while reading client request headers”

**How I encountered the problem** :  
while I config a CRL file and want to check the revocation status with browser certificate.

**Solutions I’ve tried** :  
I checked the permission of CRL file, and the “openssl crl” can shows the content normally.

Further more, I used “openssl verify -crl\_check -CAfile $(step path)/certs/ca-chain.crt -CRLfile ~/stepca/crl.pem ~/stepca/crl.crt” to simulated crl\_check, it shows normally as well.

**My config** :  
[nginx.conf]:  
ssl\_certificate conf.d/certs/.lego/certificates/192.168.195.102.crt;  
ssl\_certificate\_key conf.d/certs/.lego/certificates/192.168.195.102.key;  
ssl\_session\_cache shared:SSL:1m;  
ssl\_session\_timeout 10m;  
# ssl\_ciphers HIGH:!aNULL:!MD5;  
# ssl\_prefer\_server\_ciphers on;

```
 ssl_verify_client optional;
 ssl_client_certificate conf.d/certs/ca-chain.crt;
 ssl_verify_depth 2;

 ssl_crl conf.d/crl/crl.pem;

```

---

<div class="post-metadata">

**Author:** ![yang](https://avatars.discourse-cdn.com/v4/letter/y/77aa72/32.png) [@yang](https://community.nginx.org/u/yang)\
**Post date:** [April 16, 2025, 9:00am UTC](https://community.nginx.org/t/client-ssl-certificate-verify-error-3-unable-to-get-certificate-crl-while-reading-client-request-headers/2157/2 "2025-04-16T09:00:41Z")

</div>

supply the version of nginx and openssl:  
nginx 1.26.3  
openssl 1.1.1w

---

<div class="post-metadata">

**Author:** ![Damian\_Curry](https://avatars.discourse-cdn.com/v4/letter/d/94ad74/32.png) [@Damian\_Curry](https://community.nginx.org/u/Damian_Curry)\
**Post date:** [April 16, 2025, 4:31pm UTC](https://community.nginx.org/t/client-ssl-certificate-verify-error-3-unable-to-get-certificate-crl-while-reading-client-request-headers/2157/3 "2025-04-16T16:31:51Z")

</div>

Did you verify that the path for the `crl` file is correct in the NGINX config? In the openssl it is referencing `~/stepca/crl.pem` , but the config is using `conf.d/crl/crl.pem`, which ends up as `/etc/nginx/conf.d/crl/crl.pem` with a standard installation.

---

<div class="post-metadata">

**Author:** ![yang](https://avatars.discourse-cdn.com/v4/letter/y/77aa72/32.png) [@yang](https://community.nginx.org/u/yang)\
**Post date:** [June 6, 2025, 1:44am UTC](https://community.nginx.org/t/client-ssl-certificate-verify-error-3-unable-to-get-certificate-crl-while-reading-client-request-headers/2157/4 "2025-06-06T01:44:27Z")

</div>

Thanks a lot.  
After tried many methods, now had resolved. The key point is need to ensure the ssl\_crl was configured a CRL file which include all the CA’s crl content, and the order is the nearest CA is on the top of content, when I used “cat root.crl \>\> intermediate.crl” to get the final CRL file.

and when use “openssl verify” to check the crl\_check, when meet with “different CRL scope”, need ensure the CRL and crt ‘s CDP are the same.

---

<div class="post-metadata">

**Author:** ![system](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/system/32/19_2.png) [@system](https://community.nginx.org/u/system)\
**Post date:** [July 16, 2025, 2:51pm UTC](https://community.nginx.org/t/client-ssl-certificate-verify-error-3-unable-to-get-certificate-crl-while-reading-client-request-headers/2157/5 "2025-07-16T14:51:25Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.