How to fix Error: tlsv1 alert bad certificate (peer rejected certificate) in Node.js

Check if your client certificate is still valid:

openssl x509 -in your-certificate.pem -text -noout | grep -A 2 "Validity"

Look for:
- Not Before date (should be in the past)
- Not After date (should be in the future)

If the certificate has expired, you need to obtain a new one from your Certificate Authority.

Verify the certificate Subject and Subject Alternative Names match what the server expects:

openssl x509 -in your-certificate.pem -text -noout | grep -A 5 "Subject:"
openssl x509 -in your-certificate.pem -text -noout | grep -A 5 "Alternative Name"

Ensure the CN (Common Name) or SAN contains the correct domain or identifier that the server is expecting.

Check if you have the complete certificate chain including intermediate certificates:

openssl verify -untrusted chain.pem your-certificate.pem

If the chain is incomplete, request the intermediate certificates from your Certificate Authority and combine them:

cat your-certificate.pem intermediate1.pem intermediate2.pem > full-chain.pem

Then use the full chain in your Node.js code:

const https = require('https');
const fs = require('fs');
const tls = require('tls');

const options = {
  key: fs.readFileSync('your-key.pem'),
  cert: fs.readFileSync('full-chain.pem'), // Use complete chain
  ca: fs.readFileSync('server-ca.pem'), // Server's CA if needed
};

const req = https.request('https://server.example.com', options, (res) => {
  console.log('Connected');
});

Verify your certificate is in the correct format (PEM) and not corrupted:

# Check if it's valid PEM format
openssl x509 -in your-certificate.pem -text -noout

The file should contain:
- -----BEGIN CERTIFICATE-----
- Base64 encoded data
- -----END CERTIFICATE-----

If you have a DER format certificate, convert it to PEM:

openssl x509 -inform DER -in your-certificate.der -out your-certificate.pem

Use OpenSSL to test if the server accepts your certificate:

openssl s_client -connect server.example.com:443 \
  -cert your-certificate.pem \
  -key your-key.pem \
  -CAfile ca.pem

This simulates what Node.js is doing. Look for:
- Verify return code: 0 (ok) - Certificate accepted
- alert bad certificate - Certificate rejected by server

If OpenSSL also fails, the issue is with the certificate itself, not Node.js.

In your Node.js application, ensure you're passing the certificate correctly:

const https = require('https');
const fs = require('fs');

const options = {
  hostname: 'server.example.com',
  port: 443,
  path: '/',
  method: 'GET',
  key: fs.readFileSync('./key.pem'),
  cert: fs.readFileSync('./cert.pem'),
  // Include CA if server uses self-signed or non-standard CA
  ca: fs.readFileSync('./ca.pem'),
  // Optional: pin certificate for extra security
  // checkServerIdentity: (host, cert) => {
  //   // Custom validation logic
  // }
};

const req = https.request(options, (res) => {
  console.log('Status:', res.statusCode);
  res.on('data', (d) => {
    process.stdout.write(d);
  });
});

req.on('error', (e) => {
  console.error('Error:', e.message);
});

req.end();

Run your Node.js application with TLS debugging enabled to see the exact TLS handshake:

NODE_DEBUG=tls node your-app.js

Or programmatically:

process.env.NODE_DEBUG = 'tls';
// Then require https and make requests
const https = require('https');

The output will show the complete TLS handshake and indicate where the certificate validation fails. Look for certificate exchange messages and error alerts.

If you've verified your certificate is valid and properly formatted:
1. Contact the server's administrator and provide your certificate details
2. Ask them to verify their certificate validation rules
3. Request that they add your client certificate (or its CA) to their trust store
4. Confirm they support mTLS if that's what the connection requires
5. Ask if there are specific certificate requirements (key algorithm, signature algorithm, extensions)