The solution that worked is here:

defmodule Router.Https do

  def config() do
    [
      certfile: "cert_file",
      keyfile: "key_file",
      cacertfile: "cacert_file",
      cacerts: cacerts(),
      verify: :verify_peer,
      partial_chain: &partial_chain(cacerts(), &1),
      customize_hostname_check: [
        match_fun: :public_key.pkix_verify_hostname_match_fun(:https)
      ],
      secure_renegotiate: true,
      reuse_sessions: false,
      fail_if_no_peer_cert: true
    ]
  end

  defp cacerts() do
    "ca_client_certs_file" |> File.read() |> X509.Certificate.from_pem!() |> X509.Certificate.to_der()
  end

  def partial_chain(cacerts, certs) do
    certs = Enum.map(certs, &{&1, :public_key.pkix_decode_cert(&1, :otp)})
    cacerts = Enum.map(cacerts, &:public_key.pkix_decode_cert(&1, :otp))

    trusted =
      Enum.find_value(certs, fn {der, cert} ->
        trusted? =
          Enum.find(cacerts, fn cacert ->
            extract_public_key_info(cacert) == extract_public_key_info(cert)
          end)

        if trusted?, do: der
      end)

    if trusted do
      {:trusted_ca, trusted}
    else
      :unknown_ca
    end
  end

  defp extract_public_key_info(cert) do
    cert
    |> X509.Certificate.subject()
  end
end