Easy way to log ssl client-certificate errors with nginx?

[dubstep]

YTitle says it all.

I’d like to have logs about rejected client-certificates (expiration /
wrong site-name, etc)

What would be the right way to get such log files