I'm running WP 5.7 on Linux. It's an Nginx server.

I'm setting up an internal site with policy that requires all services using SSL client cert verification enabled.

The WP host listener has ssl config that

server {
    listen ssl;
    ssl_certificate        "/projA/wp.projA.server.crt.pem";
    ssl_certificate_key    "/projA/wp.projA.server.key.pem";
    ssl_client_certificate "/projA/corp_ca.crt.pem";
    ssl_verify_client on;
    ssl_verify_depth 2;

So far so good. Access is limited to external-connecting SSL-verified clients only. Most everything's working over SSL without any problems.

When I check WP "Site Health" I get this notice

"The REST API encountered an unexpected result.

The REST API is one way WordPress, and other applications, communicate with the server. One example is the block editor screen, which relies on this to display, and save, your posts and pages.

The REST API call gave the following unexpected result: (400) <html> <head><title>400 No required SSL certificate was sent</title></head> <body> <center><h1>400 Bad Request</h1></center> <center>No required SSL certificate was sent</center> <hr><center>nginx</center> </body> </html> ."

I'm not completely clear but that looks like WP 'internals' trying to connect to itself.

And that I need to tell WP to use & submit a "/projA/wp.projA.client.{crt,key}.pem" key pair, or disable ssl verification for internal use.

I've tracked down these


and finally this


and setup a plugin that sets

if ( '' === $_SERVER['REMOTE_ADDR'] ) {
    add_filter( 'https_ssl_verify', '__return_true', PHP_INT_MAX );
    add_filter( 'http_request_args', 'http_request_force_ssl_verify', PHP_INT_MAX );
    function http_request_force_ssl_verify( $args ) {
        $args[ 'sslverify' ] = false;
        return $args;

THAT works for disabling the verify request.

I'd rather get it right than turn it off.

Where do I setup the SSL client cert WP should use for API connections like above?


Great. With that plugin function, it doesn't report the problem as a "Recommended Improvement" anymore. NOW it's a "Critial Issue".

So clearly NOT better.

  • I'd guess it doesn't call the REST API itself except for that test. There is no reason to. So turning the test off might be the best answer here. – Rup Apr 6 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.