Irule explanation

Hi can some explain what the following Irule is looking to do

when CLIENTSSL_CLIENTCERT {

  if { [SSL::cert 0] ne "" }{

     if { not [class match -- [X509::subject [SSL::cert 0]] contains [virtual name]_cert_dgl] } {

        reject

     }

 } else { reject }

}

thanks

Andrew