During the SSL handshake,
If the server requires a digital certificate for client authentication,
the server sends a "client certificate request" that includes a list of
the types of certificates supported and the Distinguished Names of
acceptable Certification Authorities (CAs).
(quote is from a reasonably lucid explanation of the SSL handshake by IBM.)
The client then compares the certificates in its store against that list to see if it has any signed by the CAs that the server listed. If it finds one, it will send it, usually after prompting the user whether they want to send it. Presumably if there were multiple matches it would ask the user which to send (if any).
(Updating to answer comment below with regarding GAE):
This page appears to be a Google employee saying that App Engine doesn't support Client Certificate authentication. Now, that's dated 2010, so I wouldn't take it as the final word, but it is a flat-sounding "no".
This question is looking for the same thing, and that person got redirected to look into OAuth2 via Google Cloud Endpoints. Perhaps that would serve your needs well enough?