Nginx Certificate Security

server {
        listen 8443 ssl;
        listen [::]:8443 ssl;

        server_name ec2-54-152-84-236.compute-1.amazonaws.com;
        ssl_certificate /etc/ssl/certs/ec2-54-211-232-203.compute-1.amazonaws.com.crt;
        ssl_certificate_key /etc/ssl/private/ec2-54-211-232-203.compute-1.amazonaws.com.key;
        ssl_client_certificate /etc/ssl/certs/ca.crt;
        ssl_verify_client optional;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

        root /var/www/htmlp;
        index index.html;

        location / {
                if ($ssl_client_verify != SUCCESS) {
                        return 403;
                }
        }
}