Nginx SSL auth curtain client certificate
Solution 1:
All of the certificates will be validated, but you can still reject requests from connections using the other certificates by checking the DN of the client certificate.
For example:
server {
if ($ssl_client_s_dn !~ \bbase\.example\.com\b) { return 403; }
...
}