I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?
If authentication fails usually it's good practice to drop the connection/session, then log that as a security incident.
If the certificate is expired, consider contacting the responsible party via email or SMS and informing them.
If you notice a trend of invalid certificates then you may want to look into that as a potential attack (DoS or brute force).
Invalid certificates may be a configuration issue with a user, if you can ID the responsible user try to contact them. Most people don't really understand certs and can easily mess up the config.