I have been operating websites that use client certificates to authenticate the users.
To my understanding, you need to make your own CA.
First of all, that way an attacker will have huge troubles to even present a suitable certificate, meaning the website is - by default - completely inaccessible to anyone but the users that have been handed the correct client certificates. If a client certificate from a public CA were used, an attacker would be able to establish the connection (using any client certificate from that public CA), and I'd need to check the certificate's serial number, or thumbprint to authenticate the user. Which isn't a major issue, I'd be okay with that.
Second, however, while public CA have no problem issuing you certificates, there's much fewer that'll do client certificates, and they likely won't do it for free (such as let's encrypt).
The problem with the own CA is that the browsers - understandably - present a huge security warning when you try to connect to the site, before letting you choose the client certificate.
Now of course, you could add your own CA to their trust store, but for one, you aren't doing your users any good, because that obviously is a huge security issue, as while they probably trust you, you could still issue certificates for just about any website you'd like then. And second, at least from what I tried, on Android, Chrome presents warnings regardless.
So I issue client certificates from my own CA, and I tell the users to ignore the certificate warning. That doesn't sound right. How am I supposed to do it?