如何配置Nginx以提示用户从系统证书库选择客户端证书？

我需要配置Nginx，让它在HTTPS握手阶段要求并请求客户端证书，实现效果是浏览器弹出选择对话框，用户可以从macOS钥匙串访问或Windows证书存储里挑选证书。当用户访问安全页面（比如https://myapp.local）时，浏览器要提示用户从已连接的e-Token或智能卡（例如通过SafeNet、TokenD这类中间件）中选择客户端证书。

以下是我当前的Nginx配置：

server {
    listen 443 ssl;
    server_name localhost;
    
    # 服务器证书
    ssl_certificate /etc/nginx/certs/server/server.crt;
    ssl_certificate_key /etc/nginx/certs/server/server.key;
    
    # 客户端证书配置
    ssl_client_certificate /etc/nginx/certs/ca/ca.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;
    
    # SSL协议与加密套件配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    
    # 网站根目录
    root /usr/share/nginx/html;
    index index.html;
    
    # 此路径需要验证客户端证书
    location /secure {
        ssl_verify_client on;
        
        if ($ssl_client_verify = SUCCESS) {
            return 200 "证书验证成功！";
        }
        
        return 403 "未提供有效证书";
    }
    
    # 常规访问路径
    location / {
        add_header X-Client-Verify $ssl_client_verify;
        add_header X-Client-DN $ssl_client_s_dn;
        add_header X-Client-Issuer $ssl_client_i_dn;
    }
    
    # 证书信息查询接口
    location /cert-info {
        default_type application/json;
        return 200 '{
            "verify": "$ssl_client_verify",
            "subject": "$ssl_client_s_dn",
            "issuer": "$ssl_client_i_dn",
            "serial": "$ssl_client_serial"
        }';
    }
}

内容的提问来源于stack exchange，提问作者Togrul Mesimli