SSL Certificate Required
ActiveHTTP 496 SSL Certificate Required is an Nginx-proprietary status code returned when the server requires a client SSL certificate for mutual TLS (mTLS) authentication but the client did not provide one. Unlike 495 (invalid cert), 496 means no certificate was presented at all. Nginx uses this to distinguish 'no cert' from 'bad cert' in client certificate requirements.
Description
496 fires in Nginx configurations with ssl_verify_client on when the client connects over TLS but does not present a client certificate. This allows the server to redirect unauthenticated clients to a certificate enrollment page or return a clear error response. Without this distinction, both 'no certificate' and 'invalid certificate' would fall into 400 Bad Request.
Examples
server {
ssl_verify_client on;
error_page 496 = /cert-required;
# 496 fires when client provides no certificate
}Edge Cases
- •ssl_verify_client optional allows clients without certificates to connect – 496 would not fire in that case.
- •496 is Nginx-specific.
When You'll See This
- →Client attempts HTTPS connection without presenting a client certificate when mTLS is required
- →API gateway requires client certs for machine-to-machine authentication
Implementation References
| Language | Constant |
|---|---|
| Nginx | 496 (Nginx proprietary) |
History
Nginx-specific code to differentiate between missing and invalid client certificates in mTLS scenarios.
Related Status Codes
FAQ
What is the difference between 495 and 496?
495 means a certificate was provided but it was invalid. 496 means the server required a certificate but none was sent. 495 = bad cert, 496 = no cert.