I originally set it to the same value as SSLCertificateChainFile (which seems to be a fairly common pattern in Apache conf files), but @domcleal suggested that I not.  Initial googling suggests that I can/should not use my CA-issued cert to issue client certs.

http://stackoverflow.com/questions/1899983/difference-between-sslcacertificatefile-and-sslcertificatechainfile