iRule for client certificate

This is a good use case for APM's "Per Request Policy" feature. You can create URL branches which require authentication and portions of the site which does not. This could also enable "step-up" authentication use cases where access to certain parts of a site could require stronger authentication.

On-Demand Cert Authentication or ODCA is an option in a Per Request Policy.

On Demand Certificate Authentication

https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-access-policy-manager-authentication-methods/on-demand-certificate-authentication.html

How Step-up Authentication works:

https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-access-policy-manager-per-request-policies/using-step-up-authentication/concepts-to-know-for-building-step-up-authentication/how-step-up-authentication-works.html

Step-up Authentication with Client Certificate example:

https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-sso-13-0-0/20.html

SSL::renegotiate

provides a suitable example.

Look at SSL Renegotiation:

WhiteBoard Wednesday: SSL Renegotiation

SSL Profiles Part 6: SSL Renegotiation