496 SSL Certificate Required

nginx internal: a client certificate was required but none was sent; the client receives 400.

496 at a glance

Code: 496
Name: SSL Certificate Required
Class: 4xx Client error
Status: Non-standard used by nginx
Documented by: nginx
Client receives: A 400 Bad Request page; 496 appears only in nginx logs and error_page.
Cacheable by default: Not applicable: this code is never sent to the client.

What 496 means

nginx uses 496 when ssl_verify_client on is set and the client did not present a certificate. The client receives 400 "No required SSL certificate was sent". Use error_page 496 to show a friendlier page.

What typically causes a 496

Browsers without the client certificate installed, or the user cancelled the certificate prompt.
API clients not configured for mTLS (curl needs --cert and --key).
A TLS-terminating proxy in front that does not forward the client certificate.

Fix it on the server

Use ssl_verify_client optional if only some locations need certificates, and check $ssl_client_verify per location.

Fix it as a client or visitor

Configure the client certificate: curl --cert client.pem --key client.key https://....

Example response

HTTP/1.1 400 Bad Request
Server: nginx
Content-Type: text/html

<center>No required SSL certificate was sent</center>