Hi @jwilander,
Thanks for the answer. Yes, it's off, as in the default config. I am using 8.13.0 (if it matters).
[root@gitlab config]# grep ssl_client gitlab.rb
# nginx['ssl_client_certificate'] = "/etc/gitlab/ssl/ca.crt" # Most root CA's are included by default