On-Demand Certificate Authentication - Layered Virtual Server

We created the virtual server configuration mentioned here that would allow us to create a SP initiated SAML with a vendor that does not support SP Initiated SAML. Now On-Demand Certificate Authentication is no longer working. Is there a way to capture the certificate in an iRule or any other method to allow On-Demand Certificate Authentication with the layered Virtual Server configuration?