certificate_required
certificate_required (116) is a TLS 1.3 alert sent when a server requires client certificate authentication (mTLS) and the client sent an empty Certificate message. In TLS 1.2, missing client certificates were often silently accepted. TLS 1.3 makes it explicit with this dedicated alert.
Alert Code
116
Level
Fatal
Standard
RFC 8446
Description
certificate_required was added in TLS 1.3 to give a clear signal when mutual TLS (mTLS) authentication fails because the client did not provide a certificate. Previously in TLS 1.2, a server would see an empty Certificate message and might proceed or send a different error. RFC 8446 §4.4.2.4 specifies that if the server sent a CertificateRequest and the client's Certificate message is empty, the server must send certificate_required. This improves diagnostics for mTLS deployments significantly.
Common Causes
- –mTLS required but client sent no client certificate
- –Client certificate expired and was omitted rather than sending expired cert
- –Client does not have a certificate configured for this server
- –TLS client library not configured with a client certificate for mTLS