Select clientssl profile based on uri pattern

I think you could use a single client SSL profile that accepts either client cert. When the CLIENTSSL_CLIENTCERT event is triggered (before HTTP_REQUEST), you could use SSL::cert to record the client cert in a variable. Then, when the HTTP_REQUEST event is raised, you could check that the URI is correct for the cert you captured earlier.