Do you use HTTP auth on all operations or just on write? My problem (appears) to have been fixed by switching basic authentication on at the server for read operations so that the authentication had to be provided for the original clone operation as well as for subsequent writes. That said, I was doing a lot of mucking about with the setup to try and get it to work so it is possible that something else I changed actually fixed it. I haven't yet had time to check that switching auth off for read reproduces the problem for a newly cloned repo.

Your reply also raises an interesting question: should it be possible to make client certificate based authentication work just by messing about with keytool etc? That would actually work better for me than basic auth...