On demand Cert authentication - how is the client cert vaidated ?

BIG-IP renegotiates the SSL connection during Access Policy processing to request the client certificate. The chain is validated up to the certificate(s) included in the CA section of the client-ssl profile applied to the APM-enabled virtual server. Typically, you'd set the Client-Certificate section to Ignore, but be sure to set the CA section with the CA chain and/or cert that is appropriate.