Skip to content

496 SSL Certificate Required

Internal nginx code for a request that omitted a required client certificate.

Status

HTTP/1.1 496 SSL Certificate Required

Details

  • Category: 4xx
  • Status: Unofficial (nginx). Not registered with IANA. A server, framework, or CDN convention.
  • Specification: none, not defined by any RFC
  • Cacheable: Not cacheable
  • Response body: Allowed
  • Retry: Retry only after changing the request

Where ssl_verify_client is set to on, nginx requires a client certificate. If none is presented, it logs 496. The client sees a TLS handshake failure or a 400 depending on configuration.

The distinction from 495 is worth keeping: 496 means nothing was sent, 495 means something was sent and did not verify.

Common causes

  • A client that has no certificate configured for a mutual TLS endpoint.
  • A certificate installed in a store the client library does not read.

How to fix it

As the client

  • Configure the client certificate and key. In curl that is --cert and --key.
  • Confirm the library actually presents the certificate, since many need it passed explicitly rather than picked up from the system store.

As the server

  • Use ssl_verify_client optional with an application-level check when you need a clearer error than a handshake failure.

Examples

A mutual TLS endpoint with no client certificate

Log

(nginx access log)
496 "GET /secure/api HTTP/1.1" no client certificate supplied

See also