diff --git a/apps/emqx/src/emqx_authentication.erl b/apps/emqx/src/emqx_authentication.erl
index 5b12ddb4f..c35a7ea1b 100644
--- a/apps/emqx/src/emqx_authentication.erl
+++ b/apps/emqx/src/emqx_authentication.erl
@@ -202,7 +202,7 @@ do_pre_config_update({create_authenticator, _ChainName, Config}, OldConfig) ->
         NConfig ->
             {ok, OldConfig ++ [NConfig]}
     catch
-        error:{convert_cert_option, _} = Reason ->
+        error:{save_cert_to_file, _} = Reason ->
             {error, Reason}
     end;
 do_pre_config_update({delete_authenticator, _ChainName, AuthenticatorID}, OldConfig) ->
@@ -220,7 +220,7 @@ do_pre_config_update({update_authenticator, _ChainName, AuthenticatorID, Config}
         NewConfig ->
             {ok, NewConfig}
     catch
-        error:{convert_cert_option, _} = Reason ->
+        error:{save_cert_to_file, _} = Reason ->
             {error, Reason}
     end;
 do_pre_config_update({move_authenticator, _ChainName, AuthenticatorID, Position}, OldConfig) ->
diff --git a/apps/emqx_authn/src/emqx_authn_api.erl b/apps/emqx_authn/src/emqx_authn_api.erl
index 16f580d6a..93e8c4746 100644
--- a/apps/emqx_authn/src/emqx_authn_api.erl
+++ b/apps/emqx_authn/src/emqx_authn_api.erl
@@ -2024,6 +2024,16 @@ serialize_error(unsupported_operation) ->
     {400, #{code => <<"BAD_REQUEST">>,
             message => <<"Operation not supported in this authentication type">>}};
 
+serialize_error({save_cert_to_file, invalid_certificate}) ->
+    {400, #{code => <<"BAD_REQUEST">>,
+            message => <<"Invalid certificate">>}};
+
+serialize_error({save_cert_to_file, {_, Reason}}) ->
+    {500, #{code => <<"INTERNAL_SERVER_ERROR">>,
+            message => list_to_binary(
+                io_lib:format("Cannot save certificate to file due to '~p'", [Reason])
+            )}};
+
 serialize_error({missing_parameter, Name}) ->
     {400, #{code => <<"MISSING_PARAMETER">>,
             message => list_to_binary(