OpenSSL Client Certificates

generate.sh

# Extra: Generate self-signed server certificate
openssl req -nodes -new -x509 -keyout server.key -out server.crt -days 3650

# Generate CA for client certificates
openssl req -nodes -new -x509 -keyout client-ca.key -out client-ca.crt -days 3650 -subj "/CN=Client CA/O=My Company Name LTD./C=US"

# Set client name which will be used as CN
export CLIENT=bob

# Generate CSR for client certificate
openssl req -nodes -newkey rsa -keyout client-$CLIENT.key -out client-$CLIENT.csr -subj "/CN=$CLIENT/O=My Company Name LTD./C=US"

# Sign client certificate
openssl x509 -req -in client-$CLIENT.csr -signkey client-ca.key -out client-$CLIENT.crt -days 3650

# Bundle everything into one file
cat client-$CLIENT.key client-$CLIENT.crt client-ca.crt > client-$CLIENT.pem

# Cleanup
rm client-$CLIENT.key client-$CLIENT.crt client-$CLIENT.csr