SSL Caller Authentication and Access Control

Yes it is possible. Apply a clientssl profile with Client Certificate set to "require", and Trusted Cert Authority set to your CA, the apply this iRule;-

when CLIENTSSL_HANDSHAKE {
     Check if the client supplied one or more client certs
    if {[SSL::cert count] > 0}{

     Check the first client cert subject
    set subject [X509::subject [SSL::cert 0]]
}
when HTTP_REQUEST {
     Remove the customer header if already present
    HTTP::header remove "X-subject"
    HTTP::header insert "X-subject" $subject
 }