I didn't find it being an absolute nightmare, but it wasn't trivial either. Here's the configuration that works for me: http://boston.conman.org/2009/03/02/siteconf.txt

I also found that the Firefox Convergence add-on (which itself is a neat concept) breaks client certificates (which I keep forgetting, so when I hit the private areas of my secure server, I keep getting denied until I remember to disable Convergence).