requiring client SSL based on URI

Have you tried setting up two virtual servers, one on port 80 using profile http, and tcp, and the other using profile http, clientssl and tcp and using a rule?

Something like

  
  virtual http-www.example.com {  
      destination 192.168.1.1:80  
      ip protocol tcp  
      profile http tcp oneconnect 
      pool non-secure  
      rule redir  
  }  
    
  virtual https-www.example.com {  
      destination 192.168.1.1:443  
      ip protocol tcp  
      profile myclientssl tcp  
      pool secure  
  }  
    
  rule redir {  
      when HTTP_REQUEST {  
          if {[HTTP::uri] starts_with "/folder"} {  
              HTTP::redirect "https://www.example.com/secure-folder"  
          }  
      }  
  }  
  

This should work ok based on what you've described. What are the failure symptoms you're seeing?

Also, quick thing to check: are you sure that /secure-folder URI shouldn't be /secure-folder/ ? If the back end server issues a 3xx redirect, it's likely sending your client to an http://node url again. If that's the case, you can easily solve this by associating your ssl virtual with a new http profile and enabling the

redirect rewrite matching

parameter on it.