Minimal mutual TLS configuration

For authenticated service-to-service traffic, the minimum in nginx:

ssl_client_certificate /etc/nginx/ca.pem;
ssl_verify_client on;
ssl_verify_depth 2;

ssl_client_certificate is the CA that signed client certificates, not a client certificate. ssl_verify_depth bounds the chain; too small a value rejects legitimate intermediate CAs.

What actually bites: client certificates expire without renewal and calls start returning 400, so monitor expiry. ssl_verify_client optional plus a check on $ssl_client_verify is more flexible than all-or-nothing. CRLs must be refreshed by you — nginx will not fetch them — and OCSP support for client certificates is limited.

And remember mutual TLS answers "who is connecting", not "what may they do". Authorization remains yours.