Generating Client Certificate on-demand with PHP and phpseclib

clientCertSign.php

$privateKeyIntermediateCA = new \Crypt_RSA();
$privateKeyIntermediateCA->setPassword('Intermediate CA password');
$privateKeyIntermediateCA->loadKey(file_get_contents($privateCAKeyPath));

$certificateIntermediateCA = new \File_X509();
$certificateIntermediateCA->setPrivateKey($privateKeyIntermediateCA);
$certificateIntermediateCA->loadX509(file_get_contents($certificateCAKeyPath));

$clientPrivateKey = new \Crypt_RSA();
$clientPrivateKey->setPassword($password);
$generatedKeyPair = $clientPrivateKey->createKey();
$clientPrivateKey->loadKey($generatedKeyPair['privatekey']);

$clientPublicKey = new \Crypt_RSA();
$clientPublicKey->loadKey($generatedKeyPair['publickey']);
$clientPublicKey->setPublicKey();

$certificateSigningRequest = new \File_X509();
$certificateSigningRequest->setDN($certificateIntermediateCA->getDN());
$certificateSigningRequest->setDNProp('uniqueidentifier', 'my unique ID');
$certificateSigningRequest->setPublicKey((object)$clientPublicKey);

$certificateX509 = new \File_X509();
$certificateX509->setEndDate('+1 month');
$clientCertificate = $certificateX509->sign($certificateIntermediateCA, $certificateSigningRequest);

echo $clientPrivateKey->getPrivateKey();
echo PHP_EOL;
echo $certificateX509->saveX509($clientCertificate);