Even today, client cert selection in the browser is really ugly. I once needed to add client cert support to an API but because the same API was used by our SP

Even today, client cert selection in the browser is really ugly. I once needed to add client cert support to an API but because the same API was used by our SPA, enabling client certs even as optional caused the browser to display a cert prompt when the SPA made its first API call. To get around this, I ended up writing a custom IIS module that turned on client cert support only when a certain request header was present.