18.8.5.2.4. Trusted Level Features 
When MTLS is enabled on level Trusted, client certificate is
requested and verified in every SSL/TLS handshake (in initial handshake
and also in every succeeding renegotiation).
Last certificate in certificate chain supplied by the client must
be signed by one of trusted CA. None of the certificates in the chain
may be expired, otherwise handshake fails immediately and connection
is terminated.
When CRL revocation check is active, all unexpired CRLs are examined
in order to determine revocation status for every certificate in client
certificate chain.
On level Trusted are ignored all X509v3 extensions (even unknown
and critical).