Certificates used for the mTLS authentication can be generated using certstrap or any other means for generating TLS certificates (openssl, step cli).
We're following the advice of Mozilla of generating one long term root CA certificate with intermediate CA certificates signing the actual client certificates.
If your server and client supports Ed25519 certificates, add --curve=Ed25519
to init
and request-cert
commands. (Requires compilation CGO_ENABLED=0 go install github.com/square/certstrap@2a55ac3
)