accept or reject end-user certificates by issuing CA

Hi!

I have one root CA and ten sub-CA-s. In mu NGINX configuration I want to accept authentication requests for certificates issued by two sub-CA-s and reject all requests for certificates issued by any other sub-CA (including external CA-s). Basically, I want to trust only two subordinate authorities for authentication in NGINX.

How is it possible?

Thanks,

UV