See point 4 in the doc I shared above.
Your http layer TLS configuration need to also trust the client certificate. So you also need to set
xpack.security.http.ssl.certificate_authorities
with the same value as
xpack.security.authc.realms.pki1.certificate_authorities
or
xpack.security.http.ssl.verification_mode: none
( I wouldn't suggest that)