It Works!

All that fiddling around with certificate authorities was for naught. I was trying to log in with a bad certificate stored in the browser. When I inserted a smartcard everything worked as advertised.

Following four files have to be updated to configure HTTP and SSO for client certifciates:

1. ORACLE_HOME\Apache\Apache\conf\ssl.conf
2. ORACLE_HOME\sso\conf\policy.properties
3. ORACLE_HOME\sso\conf\sso_apache.conf
4. ORACLE_HOME\j2ee\OC4J_SECURITY\application-deployments\sso\web\orion-web.xm

That's it - and don't confuse yourself trying to login with a bad certificate!