IMO直接从NGINX分析qcStatement可能有点挑战性，即使你有njs，我不确定是否值得。我宁愿将原始证书传递给应用层，并在那里进行必要的检查。
以下是如何提取客户端证书并通过NGINX中的客户头将其传递给您的应用程序（下面的示例使用openresty）：

server {
    listen       443 ssl;

    ssl_certificate         /app/server.crt;
    ssl_certificate_key     /app/server.key;
    ssl_verify_client       optional;
    ssl_client_certificate  /app/certificates; // trusted client CAs

    error_page 495          /ca_error.json;
    location = /ca_error.json {
                root /app;
                internal;
            }

    set_by_lua_block $client_cert {
            ngx.req.clear_header("X-CLIENT-CERTIFICATE")
            local client_certificate = ngx.var.ssl_client_raw_cert
            -- ngx.log(ngx.STDERR, ngx.var.ssl_client_raw_cert)
            if (client_certificate ~= nil) then
                client_certificate = string.gsub(client_certificate, "\n", "")
                ngx.req.set_header("X-CLIENT-CERTIFICATE", client_certificate)
            end
            return client_certificate
    }

    location / {
        proxy_pass http://localhost:8080;
    }
}

字符串