I have an Apache server with mod_ssl that has SSLVerifyClient set to optional_no_ca. The reason for this is that (for complicated reasons) client certificate checking has to be done in the application code, rather than by letting mod_ssl check them against a CA certificate.
I've found that some clients running on Windows won't send the server their certificate, even when they've been configured to do so: is this because of the optional_no_ca setting of SSLVerifyClient? Does this change the TLS handshake so that the client is told that it doesn't need to send a certificate? If so, can my customers configure their systems to always send a certificate during the handshake?
