You'll definately need to be in SSL mode in order to check the client cert; I don't believe it would ever be sent to you in regular HTTP mode.

I don't know of any way to get the cert information in a CGI. I think you'll probably have to use mod_perl to hook into Apache's authentication handlers.