...
Ask client to optionally present an SSL client certificate - if set, the client is asked to provide a certifikatecertificate, but allowed to proceed without one. Modern browsers support this by checking the CA certificate list sent by the server - if the client has any certificates issued by one of the trusted CA certs, then it prompts the user to select one of them. If there is no match, the client continues anonymously without sending a client certificate.
...