Get Client Certificate - PQ Testing Platform

Step 1: Your Information

Your Name (will appear in public results):

Which CA should sign your certificate? Tip: For best compatibility, match CA type to certificate type (RSA cert → RSA CA)

Certificate Type:

File naming for this combination:
Every file below is prefixed with this, so each cert/CA permutation lands in your folder without overwriting the others.

Privacy Note: Your name will be publicly visible in test results. Use a pseudonym if you prefer anonymity.

Step 2: Generate CSR

Copy the command below and run it on your machine with your YubiKey inserted.

With YubiKey:

ykman piv keys generate -a rsa2048 9a pubkey.pem
ykman piv certificates request 9a pubkey.pem request.csr \
  --subject "CN=YourNameHere"

Or use OpenSSL (without YubiKey) - Click to expand

openssl req -new -newkey rsa:2048 -nodes \
  -keyout client.key -out request.csr \
  -subj "/CN=YourNameHere"

Step 3: Upload CSR

✅ Certificate Signed Successfully!

Subject:

Serial:

Signed By:

Expires: 90 days from now

Your Signed Certificate:

❌ Error

Step 4: Import Certificate

To YubiKey:

ykman piv certificates import 9a signed-cert.crt

Advanced: Import to Browser (click to expand)

Export to PKCS#12 format:

openssl pkcs12 -export -out client.p12 \
  -inkey client.key -in signed-cert.crt \
  -certfile ca.crt

Import the .p12 file to your browser's certificate manager

Step 5: Install CA Certificates

Important: Your browser/OS must trust the CA certificate(s) that signed the test server certificates. Download and install these CA certificates to your trusted root store.

Note: This is a one-time setup. Once installed, you can test with any client certificate without reinstalling CAs.

Download CA Certificates:

Install CA Certificate:

Windows:

Double-click the downloaded .crt file
Click "Install Certificate"
Choose "Current User" or "Local Machine"
Select "Place all certificates in the following store"
Click "Browse" and select "Trusted Root Certification Authorities"
Complete the wizard

macOS:

Double-click the downloaded .crt file
Keychain Access opens - add to "login" or "System"
Double-click the certificate in Keychain Access
Expand "Trust" and set "When using this certificate" to "Always Trust"

Step 6: Unplug and Reinsert YubiKey

If you imported the certificate to a YubiKey:

Unplug your YubiKey
Wait 2 seconds
Reinsert your YubiKey

This ensures your browser/OS recognizes the new certificate on the YubiKey.

Step 7: Test mTLS

Understanding server configurations:

Server Cert: The algorithm of the server's certificate private key (RSA/ECDSA/ML-DSA)
Server CA: Which CA signed the server's certificate (RSA/ECDSA/ML-DSA)
Channel: Key exchange algorithm for the TLS connection (Classical = X25519, Hybrid PQ = X25519MLKEM768)
Your client cert can be any key type - what matters is which CA signed it!

If the connection succeeds, you'll see your certificate details and connection information displayed by the server!