$ openssl req -subj '/CN=<client>' -new -key <client>-key.pem -out <client>.csr