496 SSL Certificate Required
Internal nginx code for a request that omitted a required client certificate.
Status
HTTP/1.1 496 SSL Certificate Required
Details
- Category: 4xx
- Status: Unofficial (nginx). Not registered with IANA. A server, framework, or CDN convention.
- Specification: none, not defined by any RFC
- Cacheable: Not cacheable
- Response body: Allowed
- Retry: Retry only after changing the request
Where ssl_verify_client is set to on, nginx requires a client certificate. If none is presented, it logs 496. The client sees a TLS handshake failure or a 400 depending on configuration.
The distinction from 495 is worth keeping: 496 means nothing was sent, 495 means something was sent and did not verify.
Common causes
- A client that has no certificate configured for a mutual TLS endpoint.
- A certificate installed in a store the client library does not read.
How to fix it
As the client
- Configure the client certificate and key. In curl that is --cert and --key.
- Confirm the library actually presents the certificate, since many need it passed explicitly rather than picked up from the system store.
As the server
- Use ssl_verify_client optional with an application-level check when you need a clearer error than a handshake failure.
Examples
A mutual TLS endpoint with no client certificate
Log
(nginx access log) 496 "GET /secure/api HTTP/1.1" no client certificate supplied