For reference, this is the same error we get when connecting to apache via stunnel where stunnel is configured to require a client side cert and where the browser doesn't have the cert installed.
I figured this problem is something to do with the client cert in the browser, but if it's in my browser (together with the CA cert that signed it) and is showing as 'valid', then what?