What does HTTP status 496 (Certificate Required) mean?

HTTP_STATUS_CERTIFICATE_REQUIRED

It appears in mutual TLS configurations where the server requires a certificate from the connecting client. A normal browser certificate prompt may be absent if no eligible client certificate is installed or selected.

Check the client certificate store, private-key availability, and the NGINX client-certificate verification policy. Supplying only username/password credentials does not satisfy mutual TLS.

NGINX SSL module

Operational meaning of HTTP 496 for HTTP_STATUS_CERTIFICATE_REQUIRED

HTTP 496 (HTTP_STATUS_CERTIFICATE_REQUIRED) is a client-error response. AllStat records its meaning as “496 SSL Certificate Required”. For HTTP_STATUS_CERTIFICATE_REQUIRED, interpret it with the request method, selected representation, response headers, and the specification or product that defines the code; the number alone does not prove that application work completed.

Client and server handling for HTTP_STATUS_CERTIFICATE_REQUIRED

• Treat HTTP_STATUS_CERTIFICATE_REQUIRED as a condition visible at the request boundary; inspect authentication, syntax, preconditions, routing, and resource state before retrying.
• For HTTP_STATUS_CERTIFICATE_REQUIRED, preserve the response body and challenge or retry-related headers because they often carry the actionable reason.
• For HTTP_STATUS_CERTIFICATE_REQUIRED, automatic retry is safe only when the method and status contract allow it and the request has been corrected.

For telemetry, record HTTP 496, method, authority, route template rather than secrets, response headers relevant to caching or retry, latency, upstream identity, and whether the response originated at the application or an intermediary.

Looking for a different code? Search another status or error code.