If the client is configurated to send a client certificate, the server can verify it (you have to add the certificate authority in the config file, or the certificates will be declared invalid).
This is generally used when you have deployed a PKI (Public Key Infrastructure), and/or a CA (Certificate Authority).
wzdftpd checks if the client certificate is validated (i.e, if the certificate has been signed by the server's certificate authority), and then checks that the CN field of the certificate is equal to the login name.