Dear Maxim Dounin

Hello !

Thank you for quick response.
I understand your answer.

Add
if ($ssl_client_i_dn != "...") {
return 403;
}

and I can limit access from issued intermediate CA.

Regards,
Atsushi