Hello,
IE would not prompt for a certificate, as far as I know.
FF would, but only if you have certificates installed on it.
Unlike Chrome (which uses the Windows certificate base, same as IE), FF has its own certificate base.
Since the parameter "icm/HTTPS/verify_client = 1" is set, the ICM is requesting for a client certificate as you can see at the trace:
[Thr 5264] <<- SapSSLSessionInit()==SAP_O_K
[Thr 5264] in: args = "role=2 (SERVER), auth_type=1 (ASK_CLIENT_CERT)"
Is the client certificate properly installed at the user's computer?
In addition, the root CA (Certification Authority) certificate of the CA that signed the users' certificates has to be imported at the "server PSE" of the instance.
Regards,
Isaías