After SSLVerifyClient require is enabled, why can the domain user no longer open the intranet site, and what is the scalable fix?
The server now demands a client certificate and the user has none, so the TLS handshake fails; autoenrollment issues every user a certificate automatically.
The browser shows a connection error rather than a login page: the server refuses the handshake because the client sent no certificate (or none from an accepted CA). Nothing is wrong with the server; the user simply has no certificate yet.
One option is to repeat the web-server procedure for each user: create a CSR, submit it on /certsrv, install the result. That is too complicated for an ordinary user and too much work for IT staff to do on every machine, and it also has to be repeated each year when the certificates expire.
Autoenrollment solves it: an enterprise CA plus a Group Policy setting lets every Windows domain member request, install and later renew its certificate in the background at logon. Users don't notice it happen.
Go deeper:
Apache: mod_ssl reference — SSLVerifyClientlevels (none,optional,require).