Yeah, I'm pretty sure that's not supported.
But you could implement whatever you're trying to do with a regular
regex match, if you need to. Use the built-in $clientcert variable,
which contains the node's certname.
(This assumes you're doing the default behavior of using the certname
as the node name. Hint: you almost certainly are.)