You can do this, there is nothing within Apache Httpd for normal authentication. You will need some code within your application to handle this (i.e. perform the authentication within the PHP/CGI/Java layer): this more or less excludes plain files (HTML, JS, ...) unfortunately.
To do so,
SSLVerifyClient optional_no_ca to allow any certificate to be accepted (as far as the SSL/TLS layer of Apache Httpd is concerned);
SSLCADNRequestFile to a file with just an empty line: this will make the
CertificateRequest send an empty
certificate_authorities list, which will indicate to the client that it can potentially send anything (not that it guarantees that the server will accept it). This behaviour is explicitly allowed by TLS 1.1 (and previous versions are silent on the subject). In practice, it works with SSLv3 and TLS 1.0 with most browsers.
This will allow any certificate to get presented and accepted during the SSL/TLS handshake. Unfortunately, this also removes any for of authentication Apache Httpd would have made, so none of the directives verifying CNs or other parts of the certificate will be of any use (since you can't trust the content of the certificate).
All you know at this stage is that the client has the private key for the public key in the certificate that was presented (otherwise the
CertificateVerify TLS step would have failed). You can't even trust the subject of that cert. This certificate will be in
SSL_CLIENT_CERT. You'll have to have some code to read it and extract its public key, before comparing it to your known list of public keys. (This can also work if you pass this client certificate via
mod_proxy to a back-end Java server for example.) There are libraries in PHP, Perl, Python, Java (pick the language you prefer) to analyse the content of the certificate, but it will require some programming, and will of course only authenticate the requests that are handled by such an application.