Category: Issue Certificates
Complexity: * (Medium-High)
Prerequisites: CSR available, Intermediate CA
Estimated Time: 10-15 minutes </WRAP> —- ===== Description ===== This scenario describes issuing a client certificate for mTLS authentication. Client certificates enable strong authentication of users or services to servers. Use cases: * mTLS API access * Service-to-service authentication * VPN access * Smart Card / PIV login —- ===== Code Example (C#) ===== <code csharp> using WvdS.Security.Cryptography.X509Certificates.Extensions.PQ; using var ctx = PqCryptoContext.Initialize(); Load Intermediate CA var caCert = ctx.LoadCertificate(„intermediate-ca.crt.pem“); var caKey = ctx.LoadPrivateKey(„intermediate-ca.key.pem“, „CaPassword!“); Load CSR var csr = ctx.LoadCertificateRequest(File.ReadAllText(„client.csr.pem“)); csr.VerifySignature(); Issue client certificate var clientCert = ctx.IssueCertificate( csr, issuerCert: caCert, issuerKey: caKey, serialNumber: ctx.GenerateSerialNumber(), validDays: 365, extensions: new ExtBuilder() .BasicConstraints(ca: false, critical: true) Key Usage: Only signature (no key encipherment for clients) .KeyUsage(KeyUsageFlags.DigitalSignature, critical: true) Extended Key Usage: Client Auth .ExtendedKeyUsage(ExtKeyUsage.ClientAuth) .SubjectKeyIdentifier(csr.PublicKey) .AuthorityKeyIdentifier(caCert) .CrlDistributionPoint(„http://crl.example.com/intermediate.crl“) .Build() ); clientCert.ToPemFile(„client.crt.pem“); Console.WriteLine($„Client certificate issued: {clientCert.Subject}“); </code> —- ===== Service Account Certificate ===== For microservices and automated systems: <code csharp> Service certificate with service account name var serviceCert = ctx.IssueCertificate( csr, issuerCert: caCert, issuerKey: caKey, validDays: 90, Short validity for automatic rotation extensions: new ExtBuilder() .BasicConstraints(ca: false) .KeyUsage(KeyUsageFlags.DigitalSignature) .ExtendedKeyUsage(ExtKeyUsage.ClientAuth) Service-specific SANs .SubjectAlternativeName(new[] { „dns:payment-service.internal“, „uri:spiffe:cluster.local/ns/default/sa/payment-service“ }) .Build() ); </code> —- ===== Difference to Server Certificate ===== ^ Aspect ^ Server Certificate ^ Client Certificate ^ | Extended Key Usage | serverAuth | clientAuth | | Key Usage | digitalSignature + keyEncipherment | digitalSignature | | Subject | DNS name | User/service name | | SAN Types | DNS, IP | Email, UPN, DNS | | Validity | 1-2 years | 90 days - 1 year | —- ===== PFX for Windows/Browser ===== <code csharp> Create PFX for import into browser/Windows var pfxData = ctx.ExportToPfx( certificate: clientCert, privateKey: clientKey, chain: new[] { caCert }, password: „UserPassword123!“, friendlyName: „John Doe - Client Cert“ ); File.WriteAllBytes(„client.pfx“, pfxData); </code> —- ===== Related Scenarios ===== ^ Relationship ^ Scenario ^ Description ^ | Prerequisite | 2.2 Client CSR | Create CSR | | Next Step | 9.1 mTLS Client Auth | Use certificate | | Related** | 3.1 Server Certificate | Counterpart |

« <- 3.1 Server Certificate | ^ Certificates Overview | 3.3 Code-Signing -> »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional