This patch adds the ability to use syntax like the following:
$HTTP["url"] =~ "^/url" {
  $HTTP["remoteuser"] !~ "myuser" {
    url.access-deny = ( "" )
  }
}

This makes it possible to authorize specific client certificates whenever they are used.  Sample syntax could look like the following:

ssl.verifyclient.exportcert = "enable"
ssl.verifyclient.activate   = "enable"
ssl.verifyclient.username   = "SSL_CLIENT_S_DN_CN"
ssl.verifyclient.enforce    = "disable"
ssl.verifyclient.depth      = 3
ssl.verifyclient.username = "SSL_CLIENT_S_DN_CN"
ssl.verifyclient.exportcert = "enable"
$HTTP["url"] =~ "^/url" {
  $HTTP["remoteuser"] !~ "mycertCN" {
    url.access-deny = ( "" )
  }
}

This patch has been submitted upstream in Feature request #2415, however, the last release of lighttpd was over 1 year ago.

Fix: Patch attached with submission follows: