Have IE display only certificates from a list of Cert issuers

when CLIENTSSL_HANDSHAKE
{
set cur [SSL::sessionid]
set ask [session lookup ssl $cur]
if { $ask eq "" } {
}
}
when HTTP_REQUEST
{ 
HTTP::header replace HTTPS on
set id [SSL::sessionid ]
set the_cert [session lookup ssl $id]
if { $the_cert != "" }
{
change timeout to 60 min
IP::idle_timeout 3600
set CertExpBefore [X509::not_valid_before $the_cert]
set CertExpAfter [X509::not_valid_after $the_cert]
set current_day [clock format [clock seconds] -format {%b %d %T %Y %Z}  -gmt {1} ]
set ConvertedBefore [clock scan $CertExpBefore]
set ConvertedAfter [clock scan $CertExpAfter]
set ConvertedCurrent [clock scan $current_day]
log "Before  $CertExpBefore"
log "After  $CertExpAfter"
log "Current  $current_day"
log "Before 2  $ConvertedBefore"
log "After 2 $ConvertedAfter"
log "Current 2 $ConvertedCurrent"
if { $ConvertedCurrent > $ConvertedBefore and $ConvertedCurrent < $ConvertedAfter }
{
log "In Subject getting."
set sub [X509::subject $the_cert]
set subA [getfield $sub "," 1] 
set subB [getfield $sub "," 2]
set subC [getfield $sub "," 3]
set subD [getfield $sub "," 4]
set subE [getfield $sub "," 5]
set subF [getfield $sub "," 6]
set seperator ", "
set pkiSubject $subF$seperator$subE$seperator$subD$seperator$subC$seperator$subB$seperator$subA
set iss [X509::issuer $the_cert]
set issA [getfield $iss "," 1]
set issB [getfield $iss "," 2]
set issC [getfield $iss "," 3]
set issD [getfield $iss "," 4]
set issE [getfield $iss "," 5]
set pkiIssuer $issE$seperator$issD$seperator$issC$seperator$issB$seperator$issA
$pkiSubject is the first line on PKIInfo
log "$pkiSubject"
$pkiIssuer is the third line on PKIInfo
log "$pkiIssuer"
HTTP::header insert SSL-Client-Cert [ join [string trim [string map { "-----BEGIN CERTIFICATE-----" "" "-----END CERTIFICATE-----" ""} [X509::whole $the_cert ] ] ] "" ]
HTTP::header insert CN $pkiSubject
HTTP::header insert SSLIssuer $pkiIssuer
HTTP::header insert SSLClientCertSN [string map {: -} [X509::serial_number $the_cert]]
} else {
HTTP::respond 200 content "Access Denied: Your Certificate has ExpiredAccess to this resource is denied without a valid
DoD Common Access Card or DoD approved 3rd Party PKI Certificate. If you do not have one,
please visit the  website for information on obtaining a CAC
card. Otherwise, please insert your CAC card into your
reader, close this window, and try accessing this website again to restablish your session.
"
}
} else {
HTTP::respond 200 content "Access Denied or Your Session Has Timed OutAccess to this resource is denied without a valid
DoD Common Access Card or DoD approved 3rd Party PKI Certificate. If you do not have one,
please visit the  website for information on obtaining a CAC
card. Otherwise, please insert your CAC card into your
reader, close this window, and try accessing this website again to reestablish your session.
"
}
}