The correct link - http://blogs.technet.com/b/nettracer/archive/2013/12/30/how-it-works-on-the-wire-iis-http-client-certificate-authentication.aspx Posted at Nginx Forum: http://forum.nginx.org/read.php?2,260279,260280#msg-260280