diff --git a/httplib.h b/httplib.h
index 3cefcfde..40902e2e 100644
--- a/httplib.h
+++ b/httplib.h
@@ -18955,7 +18955,9 @@ inline bool SSLServer::update_certs_pem(const char *cert_pem,
     return false;
   }
   if (client_ca_pem) {
-    return tls::update_server_client_ca(ctx_, client_ca_pem);
+    if (!tls::update_server_client_ca(ctx_, client_ca_pem)) { return false; }
+    // As in the constructors, a client CA makes client certificates required
+    tls::set_verify_client(ctx_, true);
   }
   return true;
 }
diff --git a/test/test.cc b/test/test.cc
index d32001a8..639f0fd3 100644
--- a/test/test.cc
+++ b/test/test.cc
@@ -16221,15 +16221,24 @@ TEST(SSLClientServerTest, ClientCertStillRequiredAfterVerifyCallbackCleared) {
   });
 }
 
+void UpdateCertsPemWithClientCA(SSLServer &svr) {
+  std::string cert_pem, key_pem, ca_pem;
+  read_file(SERVER_CERT_FILE, cert_pem);
+  read_file(SERVER_PRIVATE_KEY_FILE, key_pem);
+  read_file(CLIENT_CA_CERT_FILE, ca_pem);
+  ASSERT_TRUE(
+      svr.update_certs_pem(cert_pem.c_str(), key_pem.c_str(), ca_pem.c_str()));
+}
+
+TEST(SSLClientServerTest, UpdateCertsPemWithClientCARequiresClientCert) {
+  SSLServer svr(SERVER_CERT_FILE, SERVER_PRIVATE_KEY_FILE);
+  ASSERT_TRUE(svr.is_valid());
+  UpdateCertsPemWithClientCA(svr);
+  RejectsClientWithoutCert(svr);
+}
+
 TEST(SSLClientServerTest, ClientCertStillRequiredAfterUpdateCertsPem) {
-  ClientCertStillRequired([](SSLServer &svr) {
-    std::string cert_pem, key_pem, ca_pem;
-    read_file(SERVER_CERT_FILE, cert_pem);
-    read_file(SERVER_PRIVATE_KEY_FILE, key_pem);
-    read_file(CLIENT_CA_CERT_FILE, ca_pem);
-    ASSERT_TRUE(svr.update_certs_pem(cert_pem.c_str(), key_pem.c_str(),
-                                     ca_pem.c_str()));
-  });
+  ClientCertStillRequired(UpdateCertsPemWithClientCA);
 }
 
 // A TLS error from one request must not show up in a later request's Result