Solved OAM 2-way SSL problem, but don't know why?

Hi,

I was trying to enable an OAM 11gR2 PS3 instance I had for doing 2-way/client-authenticated SSL PKI authentication (FYI, I mean being able to authenticate incoming users using client certs, and I am not meaning enabling CERT-mode webgate-to-OAM server connections). 

I know that, over the years, I must've done this dozens of times before, but this time there were several environmental things that were a little different from my "normal" experience.  I did finally get it working last night, but now I am curious about why I had to do some of the things that I had to do to get it working.