Open Radar

 
If you have some site or domain, that required client certificate, then Safari will created Idetity References in Keychain in follow format:
Name: "https://sample.apple.com (com.apple.Safari)"
Where: "https://sample.apple.com (com.apple.Safari)"

But if someone send you a link to this service:  https://sample.apple.com/foo/bar/page/link?some=param and you opened that link, then Safari may ask about certificate or may not and use existing one "https://sample.apple.com (com.apple.Safari)". If it ask again, then Safari will add into Keychain second one Identity Reference:
Name: "https://sample.apple.com/foo/bar/page/link?some=param (com.apple.Safari)"
Where: "https://sample.apple.com/foo/bar/page/link?some=param (com.apple.Safari)"

You can repeat this for different URLs on this domain, and as result you will get many many Identity References inside your Keychain. It starts messed up and as result your Safari may start refuse SSL connection at all. You will not able to login into site.

For always reproduce try start with empty Keychain but from not root of site. Just go on some page inside this site: https://sample.apple.com/foo/bar/page/link?some=param. In this case Safari will ask you about certificate any time when you will visit site and end up with total mess in Keychain with unable to establish SSL connection at all.