Broad title, I know...

Assuming for a self-hosted webserver:
<ol>
<li>
 the webserver only hosts a static html website
</li>
<li>
 iptables is used to reject every IP except a few known ones
</li>
<li>
 only Port 443 is forwarded and the website requires SSL via client certificates
</ol>

What kind of dangers remain? (Disregarding security holes in a patch)