A new Howto on enabling x509 certificates authentication with Sunstone has been included in the OpenNebula wiki

This guide shows how to enable and use x.509 certificates for authentication in OpenNebula Sunstone. In this configuration, the authentication is delegated to Apache, or any SSL capable HTTP Proxy. If the certificate is valid, the server encrypts those credentials and sends the token to OpenNebula.

Howto: http://wiki.opennebula.org/sunstone_x509