Create client cert with openssl

client-cert.sh

# create new client key
openssl genrsa -out dhclient.key 2048

# create CSR from key
openssl req -new -key .\client.key -out client.csr

# create .key file from cert
openssl pkcs12 -in cert.p12 -nocerts -out cert.key -nodes

# create .pem file from cert
openssl pkcs12 -in cert.p12 -nokeys -clcerts -out cert.pem

# fulfill CSR
openssl x509 -req -in client.csr -CA cert.pem -CAkey cert.key -CAcreateserial -out client.pem -extfile client.ext -days 365 -sha256

# convert back into .p12
openssl pkcs12 -export -inkey client.key -in client.pem -out client.p12