I understand that most commercial browsers will stop trusting websites with SHA-1 PKI certificates by Jan 2017 so it is critical for websites to update to SHA-2 by that time. My question is, is it also critical for end-users to update their personal PKI certificates to SHA-2 by Jan 2017 to still be able to authenticate themselves to websites requiring certificate-based authentication? That is, will the browsers also stop supporting sending of SHA-1 certificates to websites during mutual authentication?
Web browsers will accept SHA-1 client authentication certificates. However, Web server may reject this certificate if authentication server (domain controller, for example) does not support SHA-1.
I think that most authentication servers will accept SHA-1 client certificates (at least Active Directory will do), because they are not subject of depreciation policy, but I would strongly recommend to upgrade your CAs to sign certificates with SHA-2.
As far as I know, creating collisions for SHA1 hashes for certificates is theoretically possible but it still requires ~2^61 SHA compression (according to this paper from 2011). I don't know if there is more recent research on this topic with different results. The complexity of 2^61 means that only the most powerful players like NSA, etc. can produce a certificate that has the same hash as yours. If you are a high value target, then you should issue a new certificate but if you were you probably wouldn't have posted on this site.