try Rack in addition to Apache clientcert fieldname