In IIS you can force client certificate request mais can it exclude some pages ? How is it by coding (sample code somewhere ?) or by configuration ?
Same question for Apache / Java
For Apache, the question is easily answered: use the directive SSLVerifyClient in a Directory context. See the mod_ssl documentation for more info.