What do SSLCACertificateFile, SSLVerifyClient require and SSLVerifyDepth 2 do in Apache, and why must the CA chain be converted from .p7b to PEM first?

They make Apache demand a client certificate in the TLS handshake and accept it only if it chains to the given CA certificates within two levels; Apache reads CA certificates as PEM, not PKCS#7.

• SSLCACertificateFile /etc/ssl/certs/ckteck-ca.pem: the CA certificates Apache trusts for client certificates. During the handshake Apache also sends their names to the browser as "acceptable issuers", so the browser offers only matching certificates.
• SSLVerifyClient require: the server sends a CertificateRequest; a client without a valid certificate is refused during the handshake, before any HTTP is exchanged. (optional would let the request through and leave the decision to the application.)
• SSLVerifyDepth 2: how many CA certificates may sit above the client certificate. Here user certificate, then CKTECK CA (depth 1), then the root (depth 2). A longer chain is rejected.

Formats: the CA's web page offers the chain as PKCS#7 (.p7b), a container holding several certificates, common in the Windows world. Apache wants PEM: Base64 certificates between -----BEGIN CERTIFICATE----- lines, several simply concatenated in one file. openssl pkcs7 -print_certs -in ca-chain.p7b -out ckteck-ca.pem unpacks the container into that form.

Go deeper:

• Apache: mod_ssl reference — SSLVerifyClient, SSLVerifyDepth and SSLCACertificateFile with their exact semantics.
• Wikipedia: Privacy-Enhanced Mail (PEM) — the Base64 text format.
• Wikipedia: PKCS 7 — the .p7b container.