iRule for client certificate verification and inserting CN

tls session must be created before http session begins (including client's first http request).

in order for f5 to be able to send http 401, then you have to ALLOW ALL clients tls session setup requests, regardless of the client tls cert validity.
and then use when HTTP_REQUEST to be able to read request URL and evaluate client certificate
(use Request mode instead of Require in vserver's client side ssl profile: https://my.f5.com/manage/s/article/K14819)