telnet SSL (Client Access) security

Has anyone successfully and securely implemented Client Access over the
Internet?  We are on V4R4 and have all the required products installed to
support SSL (I've done it before locally, just not over the Internet).

I am wondering if the server (or client for that matter) supports client
authentication by certificate.  Basically, I want to generate certificates
on the AS/400 for each user and ONLY allow users with valid certificates.
Then I can disable the certificate to prevent access by that user.

I found where I can change trust on CA certificates which can let me accecpt
only CERTAUTH(1) which is certificates signed by my system I think.  That
should at least prevent someone from getting a Verisign certificate and
getting a signon screen.

I'm not sure what has changed since it last worked, but I'm now getting an
error (even on the LAN).

CPE3447   A remote host did not respond within the timeout period.
TCP2554   Server job received an SSL socket handshake error -10.

I welcome any suggestions on my specific error as well as comments about CA
and Internet security in general.