Sun Microsystems Netscape Enterprise Server Administrator's Manual page 329

When a server with client authentication enabled receives a request, the server
performs the following actions:
When the browser sends the certificate, the server checks if the certificate is
1.
from a trusted CA. If not, the server ends the transaction, and the
authorization fails.
If the certificate is from a trusted CA, the server maps the certificate to a
2.
user's entry using the certmap.conf file. See "Using the certmap.conf
File" on page 136 for more information on setting up the certificate
mapping file.
If the certificate maps correctly, then the web server checks the ACL rule
3.
specified for that user. Therefore, even though the certificate maps
correctly, if the ACL denies the user access, the rule can deny the request.
The web server looks up the entry in an LDAP directory, so the access appears
seamless to the end user.
Requiring client authentication for controlling access to specific resources is
different than requiring client authentication for all connections to the server.
To require client authentication with access control, choose the SSL
authentication methods you want to use from the Encryption Preferences page
(in the Preferences tab, click Encryption Preferences). To require client
authentication for the entire server, select "Require Client Certificates
(regardless of access control)" in the Encryption Preferences page.
Only the SSL authentication method requires modification to the
Note
certmap.conf file. Allowing client authentication for all connections to the
server does not.
In order for a client to successfully gain access to a SSL authenticated resource
requiring client certificates, the client must install a certificate on their browser
which is from a certificate authority trusted by the web server. It may be
necessary to have the same client certificate published in a directory server if
the web server's certmap.conf file is configured to compare the entire
certificate between the client's certificate in the browser and the client
certificate in the directory server entry. However, the certmap.conf file can
be configured so that it only compares selected information from the certificate
to the entry in the directory server. For example, you can configure the
certmap.conf file so that the server only compares a user ID and an email
What Is Access Control?
Chapter 14, Controlling Access to Your Server 329