Seems like somebody definitely misconfigured something somewhere. The question is then was this the direct result of the misconfiguration, or someone abusing a misconfiguration. Client certificates can be used to identify people so this is a good way to mass collect certs. This data could also be used to analyse client certificates that are around.
I'm not alone in this, also happened to my friend, and also posted to Reddit:
https://www.reddit.com/r/techsupport/comments/1u7h672/browser_asking_me_to_select_certificate_is_it_a/
Seems like somebody definitely misconfigured something somewhere. The question is then was this the direct result of the misconfiguration, or someone abusing a misconfiguration. Client certificates can be used to identify people so this is a good way to mass collect certs. This data could also be used to analyse client certificates that are around.