Thanks for sharing @manish. Certificates can definitely be tricky 
For others that come across this I copied & pasted this from the docs as well:
By default, when using client certificates, the common name (CN) in a client certificate’s subject is used as the client username.
So your certificate’s CN must match yourclient-usernameto authenticate and then thatclient-usernamehas aclient-profileandacl-profilewhich define what permissions are authorized