I guess you want to enroll users by POSTing CSRs. There is already enrollment schemes builtin browsers so you dont have to POST CSR's. Those enrollment schemes will also automatically install the client certificate in the browser store, so Everything is done in one shot.
Here you have Everything to get started:
This should take care of Everything. Now, your only problem is authenticating users as users Before enrolling them.
I guess this is the problem you want to solve, in other Words, authenticating users so not anyone can enroll themselves, eg only specific invited indivuals should get a account.
If you can provision software to the client computers via some administration suite, you could provision a "RunOnce" that contains a url like http://www.example.com/CSREnroll.cgi?key=sgdghdghdkgkdsgfketgebgkebekgbksdhfbkgbavbkajvbebkjgbtkekagb where key= is a securely generated, random one-time key, that allows enrollment of one certificate. Since your provision software will propably be able to know the client's IP, you could also lock the key= to only be valid to the IP in question, thus gaining extra security so if this one-time key would leak out prior to its usage, it would be impossible to use it.
If you dont have any administration suite and no possibility to identify users today, I would suggest manual enrollment. This can be done by setting up a password protected enroll page that only you as a administrator know the password of, and then you physically visit each user and enroll them.
Installing a one-time certificate is a unneccessary step, since you would still have to verify the users prior to installing the one-time certificate. And if you have verified the users as authorized, then you dont need to take the step of installing a one-time certificate.
If the users are located not so near, you need to establish Another way to verify the users. Lets say the users need to call the "Helpdesk" to get a account, and verify themselves with a customer representative. Then you could make a page where they have to enter a 8 digit "enrollment ID" that you give to them over the phone after successful verify. This enrollment ID could have a validity of about 5 minutes giving maximal security.
You could even have a challenge that they have to read to you, you enter all details that should be written in certificate, they get a response, and they have to type the response to get their cert enrolled.