Thanks a lot! It needed some tinkering but I've made it work. I was struggling mostly with the firewall blocking the CLR validation during testing. I've found the CLR can be disabled on the IIS level by setting the verifyclientcertrevocation to disable:

  Hope this will save some headaches  

Great article. Typical Murray's standard of documentation!

I have one small correction.  In step 3 of the runtime process, it references the "Client Certificate Issuers" store.   This should be changed to the "Client Authentication Issuers" store.   The former does not exist.

This feed has lost its formatting since moving to the new Community portal. I suggest that you convert it to a KB article.