# Create TLS client certificates (for testing)

For testing and development purposes we reuse
the bare bones certificate authority from the
[development-ca.md](development-ca.md).

(In production setups, it is very likely that two different CAs
would used for server and for client certificates.)

The following lines directly create the client certificate.
(As opposed to first creating a certificate signing request and
then signing it.)

```bash
# being in devca1/
certtool --generate-privkey --outfile testclient1-key.pem

echo '
organization = "CSAF Tools Development (internal)"
country = DE
cn = "TLS Test Client 1"

tls_www_client
signing_key
encryption_key

serial = 020
expiration_days = 50
' > gnutls-certtool.testclient1.template

certtool --generate-certificate --load-privkey testclient1-key.pem --outfile testclient1.crt --load-ca-certificate rootca-cert.pem --load-ca-privkey rootca-key.pem --template gnutls-certtool.testclient1.template

certtool --load-ca-certificate rootca-cert.pem --load-certificate testclient1.crt --load-privkey testclient1-key.pem --to-p12 --p12-name "Test Client 1" --null-password --outder --outfile testclient1.p12
```

and we do a second one with shorter expiration day:

```bash
certtool --generate-privkey --outfile testclient2-key.pem

echo '
organization = "CSAF Tools Development (internal)"
country = DE
cn = "TLS Test Client 2"

tls_www_client
signing_key
encryption_key

serial = 021
expiration_days = 1
' > gnutls-certtool.testclient2.template

certtool --generate-certificate --load-privkey testclient2-key.pem --outfile testclient2.crt --load-ca-certificate rootca-cert.pem --load-ca-privkey rootca-key.pem --template gnutls-certtool.testclient2.template

certtool --load-ca-certificate rootca-cert.pem --load-certificate testclient2.crt --load-privkey testclient2-key.pem --to-p12 --p12-name "Test Client 2" --null-password --outder --outfile testclient2.p12
```