There is support for (ha)proxy protocol in both nginx and Gunicorn to pass out-of-band information, but it has a pre-defined list of fields and while those seem to include whether the client cert auth passed, there's no field for the cert or its fingerprint, which I need to check which user the the cert is assigned to.