Spring Security - can I use X509 Certificate as an extra layer in authentication?

Question

I am building an Android App which communicates with my REST API that is protected by Spring Security.

Since the Android App is "public" and no keys etc is secu