diff --git a/src/ssl_key_handler.cpp b/src/ssl_key_handler.cpp
index cc11360..128d1f2 100644
--- a/src/ssl_key_handler.cpp
+++ b/src/ssl_key_handler.cpp
@@ -4,6 +4,7 @@
 
 #include "bmcweb_config.h"
 
+#include "forward_unauthorized.hpp"
 #include "logging.hpp"
 #include "ossl_random.hpp"
 #include "sessions.hpp"
@@ -545,19 +546,34 @@
     const persistent_data::AuthConfigMethods& c =
         persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
 
+    boost::asio::ssl::verify_mode mode = boost::asio::ssl::verify_none;
     if (c.tlsStrict)
     {
-        BMCWEB_LOG_DEBUG("Setting verify peer");
-        boost::asio::ssl::verify_mode mode =
-            boost::asio::ssl::verify_peer |
-            boost::asio::ssl::verify_fail_if_no_peer_cert;
-        boost::system::error_code ec;
-        sslCtx.set_verify_mode(mode, ec);
-        if (ec)
-        {
-            BMCWEB_LOG_DEBUG("Failed to set verify mode {}", ec.message());
-            return nullptr;
-        }
+        BMCWEB_LOG_DEBUG("Setting verify peer and fail if no peer cert");
+        mode |= boost::asio::ssl::verify_peer;
+        mode |= boost::asio::ssl::verify_fail_if_no_peer_cert;
+    }
+    else if (!forward_unauthorized::hasWebuiRoute)
+    {
+        // This is a HACK
+        // If the webui is installed, and TLSSTrict is false, we don't want to
+        // force the mtls popup to occur, which would happen if we requested a
+        // client cert by setting verify_peer. But, if the webui isn't
+        // installed, we'd like clients to be able to optionally log in with
+        // MTLS, which won't happen if we don't expose the MTLS client cert
+        // request.  So, in this case detect if the webui is installed, and
+        // only request peer authentication if it's not present.
+        // This will likely need revisited in the future.
+        BMCWEB_LOG_DEBUG("Setting verify peer only");
+        mode |= boost::asio::ssl::verify_peer;
+    }
+
+    boost::system::error_code ec;
+    sslCtx.set_verify_mode(mode, ec);
+    if (ec)
+    {
+        BMCWEB_LOG_DEBUG("Failed to set verify mode {}", ec.message());
+        return nullptr;
     }
 
     SSL_CTX_set_options(sslCtx.native_handle(), SSL_OP_NO_RENEGOTIATION);