Yes it’s running in my reverse proxy.
Nginx is doing my “client ssl verify” in front of my web services.
You can even do this on a per uri/location.
For example, my nextcloud is open without client certs so I can share files with people, but the admin settings path is protected by client ssl.
Cat per square inch is a good unit