<p>I am trying to configure NGINX ingress controller where it can also validate unique CN or Subjectname coming from the client. Reason being , we only want a client to be configured to access NGINX ingress controller &amp; rest of the clients which are signed using same CA &amp; key can be dropped.</p>

<pre><code>    Certificate:
Data:
    Version: 1 (0x0)
    Serial Number: 2 (0x2)
Signature Algorithm: sha256WithRSAEncryption
    Issuer: CN=testAuthority
    Validity
        Not Before: Apr  5 08:02:23 2020 GMT
        Not After : Apr  5 08:02:23 2021 GMT
    Subject: CN=**client**
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
            Public-Key: (4096 bit)
       Public Key Algorithm: rsaEncryption
            Public-Key: (4096 bit)
            Modulus:
       &lt;snipped&gt;
            Exponent: 65537 (0x10001)
Signature Algorithm: sha256WithRSAEncryption
&lt;snipped&gt;
-----BEGIN CERTIFICATE-----
&lt;snipped&gt;
 -----END CERTIFICATE-----
</code></pre>

<p>If the request to NGINX controller is received from above certificate like <strong>Subject: CN</strong> or Certificate Key or Fingerprint then it should be forwarded to backend . 
Rest of the certificates should be rejected.</p>

<p>If there is some annotation or configmap that could be configured in Ingress , it could be helpful.</p>

<p>You may try to <a href="https://stackoverflow.com/a/56168919/7482990">extract CN</a> <a href="https://stackoverflow.com/questions/55325548/getting-common-name-from-distinguished-name-of-client-certificate-in-nginx">into variable</a> and then deny access based on this variable via <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/customization/configuration-snippets/ingress.yaml#L6" rel="nofollow noreferrer">configuration snippet</a>. One of possible workarounds is to use additional Ingress with dedicated CA + client certificate authentication and issue client certificates to allowed clients only.</p>
