Dear Maxim Dounin Hello ! Thank you for quick response. I understand your answer. Add if ($ssl_client_i_dn != "...") { return 403; } and I can limit access from issued intermediate CA. Regards, Atsushi Posted at Nginx Forum: https://forum.nginx.org/read.php?2,263895,263936#msg-263936