NodeJS and AngularJS - Secure REST API with Client Certificate Authentication

I am currently working on making my REST Api Server (NodeJS + Express + Mongoose) secure, so nobody, except my client application (AngularJS 1.6) and my admin application (based on AngularJS 1.6), can access the routes and fetch or put data into my database. Everything is running on https with a valid SSL certificate.

I mainly thought about two approaches:

1. Shared secret keys where specific routes needs an "access key"
2. Client certificate authentication

I went with no. 2, because in my thoughts this is the most secure (please correct if I am wrong :))

So I set up my API Server to run on https and request a valid client certificate:

var options = {
    ca: fs.readFileSync(__dirname + "/cert/server.ca"),
    key: fs.readFileSync(__dirname + "/cert/server.key"),
    cert: fs.readFileSync(__dirname + "/cert/server.crt"),
    requestCert: true,
    rejectUnauthorized: false
};

https.createServer(options, app)
    .listen(PORT, () => {
        console.log(`up and running @: ${os.hostname()} on port: ${PORT}`);
        console.log(`enviroment: ${process.env.NODE_ENV}`);
    });

I handle the rejection of unathorized users directly in the app via:

if (!req.client.authorized) {
    var cert = req.socket.getPeerCertificate();
    console.log("unauthorized: ", cert);
    return res.status(401).send('Not authorized!');
}

And here the problems begin :). On every request my client application does I receive an error:

401 - not authorized

I thought that the client application is sending the SSL certificate with every request (or if requested by nodejs) via "requestCert" and everything is working just fine. But it seems to be a bit more complicated.

In my server.ca file I currently have the certificate chain which I received from the CA.

In console.log the transmitted certificate in the request, but its always empty.

What am I doing wrong? Do I have to configure Angular to send it along with every request? Any suggestions?