ssl – How to configure Nginx to prompt the user to select a client certificate from OS certificate store (e.g., e-Token on macOS/Windows)?

I’m trying to configure Nginx to require and request a client certificate during HTTPS handshake — specifically in a way that prompts the browser to show the user a selection dialog from the Keychain Access (macOS) or Certificate Store (Windows).

When a user navigates to a secure page (e.g., myapp.local), I want the browser to prompt them to select a client certificate from their connected e-Token or smart card (e.g., using middleware like SafeNet or TokenD).

This is my current nginx configuration:

server {
    listen 443 ssl;
    server_name localhost;
    
    # Server certificate
    ssl_certificate /etc/nginx/certs/server/server.crt;
    ssl_certificate_key /etc/nginx/certs/server/server.key;
    
    # Client certificate settings
    ssl_client_certificate /etc/nginx/certs/ca/ca.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;
    
    # SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    
    # Root directory
    root /usr/share/nginx/html;
    index index.html;
    
    # This location will require a client certificate
    location /secure {
        ssl_verify_client on;
        
        if ($ssl_client_verify = SUCCESS) {
            return 200 "Certificate verification successful!";
        }
        
        return 403 "No valid certificate provided";
    }
    
    # Regular location
    location / {
        add_header X-Client-Verify $ssl_client_verify;
        add_header X-Client-DN $ssl_client_s_dn;
        add_header X-Client-Issuer $ssl_client_i_dn;
    }
    
    # API endpoint
    location /cert-info {
        default_type application/json;
        return 200 '{
            "verify": "$ssl_client_verify",
            "subject": "$ssl_client_s_dn",
            "issuer": "$ssl_client_i_dn",
            "serial": "$ssl_client_serial"
        }';
    }
}