Once the CA hierarchy has been initialised, it should be possible to issue client certificates.

The following should be done:

• Implement client certificate issuance command.
• Client issuance command should:
  • Generate the client private key.
  • Issue the client certificate using the lead CA from the hierarchy.
  • Provide user with information on what has been created.
• Client certificate issuance command should accept the following mandatory arguments:
  • Entity name.
• Client certificate issuance command should be implemented with the following constraints in mind:
  • Don't be destructive. If the certificate has already been issued, show a warning to user.
  • Artifacts should be stored within a sub-directory called .gimmecert/client/.
  • Subject DN should be of format CN=NAME, where NAME is the name provided by user.
  • Issued certificate should have a standard set of TLS key usages and extended key usages.
  • Client certificate should be issued by the leaf CA (furthest away from the root/level 1 CA).
  • Certificate validity should not exceed the CA validity.
  • Validity should start at time of issuance minus 15 minutes.
• Documentation should cover:
  • Command usage, with just the entity name being provided.
  • Directory and file layout structure of generated artifacts.
  • Information about what CA is used for issuance.
  • Information about how the subject DN is constructed.