You are mixing the certificates. There are really two types: Server certificates and client certificates. Client certificates are given out to individuals users to present to the machine for validation before entering the site. One would most likely use them on Microsoft to map to NT accounts for ACL level permissions on files or directories. You could also use them for tighter control of who accesses the web server/application. So client certificates are used for authentication. You would need to install cetificate server and follow the instructions carefully from the knowledge base articles as there are funky gotchas (most notably that you have to name the certificate fields in a certain way that does not make logical sense and make a change to the meta-data to check for revocation of the certificates). Then all users would be given security certificates that she would have to install on every machine she accessed the web site from. Then you would map to NT accounts. This is quite a big task to undertake for novices as you have to manage all the certificates and revocation, make some scary changes and probably do some programming.
If you are looking just for encryption of web traffic then the server certificate is enough to give you that, but you have to disable 'require client certificate.'
If you are issuing your own SSL certificate and installing it on the server, the user has to pass the non-CA prompt on the screen the first time and then install it. Also you must always use https:// if you check the require secure channel.
Recommended, however, is the use of trusted security certificates from the likes of Thawte or Verisign, which you install onto the server once and renew annually orbi-annually. You would use key manager in the IIS management to do this.
You could then turn on either NT or basic authentication in IIS to secure the web site.
