496 SSL Certificate Required

When a request arrives without the required client certificate for mutual TLS, nginx responds with 496 SSL Certificate Required.

Table of Contents

Usage

The 496 SSL Certificate Required status code indicates the client sent an HTTP request without an SSL certificate, yet the server requires one for the requested resource. Resolving this error requires resubmitting the request with a valid client certificate attached.

Example

A client sends a request to a resource requiring mutual TLS, but provides no client certificate. The nginx server records the failure as 496 SSL Certificate Required and, in the default configuration, answers the client with a 400 response carrying the built-in error page.

Request

GET /secure/internal HTTP/1.1
Host: www.example.re

Response

HTTP/1.1 400 Bad Request
Server: nginx
Content-Type: text/html
Connection: close

<html>
<head><title>400 No required SSL certificate was sent</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<center>No required SSL certificate was sent</center>
<hr><center>nginx</center>
</body>
</html>

The nginx error log records the missing certificate:

client sent no required SSL certificate

How to fix

The server expects a client certificate for mutual TLS (mTLS) and the client sent none. The fix depends on whether the client or server configuration needs to change.

Client-side fix

Install the required client certificate in the browser, operating system trust store, or HTTP client library. For curl, pass the certificate and key:

curl --cert client.pem --key client-key.pem \
  https://www.example.re/secure/internal

For browser access, import the .p12 or .pfx certificate bundle into the browser's certificate manager. The browser presents the certificate automatically during the TLS handshake when the server requests one.

Server-side fix

Check the ssl_verify_client directive. Three values control behavior:

# Reject if no cert (strict mTLS)
ssl_verify_client on;

# Accept with or without cert
ssl_verify_client optional;

# Accept without cert, skip CA verification
ssl_verify_client optional_no_ca;

Setting the value to optional allows requests without certificates to proceed while still verifying certificates when presented. This is useful for endpoints serving both authenticated and anonymous traffic.

Verify the ssl_client_certificate directive points to a valid CA bundle file containing all trusted root and intermediate certificates:

ssl_client_certificate /etc/nginx/ca-chain.pem;
ssl_verify_client on;

Use error_page 496 to serve a helpful error page or redirect to a login page instead of the default nginx error:

error_page 496 =301 https://$host/login;

See also

Last updated: August 11, 2026