CN-based client authentification with nginx. This emulates Apache's SSLRequire (%{SSL_CLIENT_S_DN_CN} in {"Really Me"})

nginx_client_cn_auth.conf

map  $ssl_client_s_dn  $ssl_client_s_dn_cn {
	default "";
	~/CN=(?<CN>[^/]+) $CN;
}

server {
	listen 80;
	listen [::]:80;

	listen 443 ssl;
	listen [::]:443 ssl;
	
	server_name foo.bar.com;

	if ($scheme = http) {
		return 301 https://$server_name$request_uri;
	}

	ssl_certificate /etc/ssl/$server_name;
	ssl_certificate_key /some/where/private;
	ssl_client_certificate /the/root/of/all/client/cas.pem
	ssl_verify_depth 3;
	ssl_verify_client optional;

	location ~ ^/safe {
		if ($ssl_client_verify != SUCCESS) {
			return 401;
		}

		if ($ssl_client_s_dn_cn !~ "Really Me") {
			return 401;
		}
	}
}