When IE is connected to a server via SSL protocol and the
server is configured to require client authentication, then IE
will only present you local certificate that:
- are in the Current User MY certificate store
- certificate must be time valid
- issuer of cert must be in local client trusted root CA list
- issuer of cert must be in the server trusted root CA (depends on server config)

I have generated test S/MIME certs using MS PSDK tool   makecert.exe and
these work properly with IIS5 (haven't checked yet with Tomcat ..).
With IIS5 these self-signed test certificates are ONLY shown to the client if
the IIS server machine has the public (self) cert also in the Local Machine Trusted
Root cert store.

Not sure about the *minimum* requirements of the client certificate in terms
of what Extensions (key restrictions etc..) are required, but I *think* when the
cert/keys are generated or imported into IE, they need to be marked in CryptoAPI
as AT_KEYEXCHANGE  (since IE uses CryptoAPI for all cert handling)
but the following cert generation command works for test purposes:

makecert -pe -sp "Microsoft Enhanced Cryptographic Provider v1.0"
     -sky Exchange -r -n "E=youremail@yourdomand.bla,CN=MY CN" -ss MY

Generates an exportable (pe) and 1024 bit RSA key pair (Enhanced provider) marked
as type AT_KEYEXCHANGE  and self-signed (-r) with SubjectName field (-n) as
shown and adds to the Current User MY certificate store (only one searched by IE for client certs).

- Michel Gallant
  Visual Security MVP
  http://pages.istar.ca/~neutron