How to generate a client certificate?

[michalwilk96]

Hello,
I've generated root CA, server key and crt from instruction: https://github.com/open-quantum-safe/oqs-demos/blob/main/nginx/USAGE.md

Now I'd like to generate client certificate signed by this CA in order to use it to connection for the setup mentioned above.
Thank you for the help.

[baentsch]

This question is not specific to OQS, so allow me to suggest reading up on cert management, e.g., using openssl, e.g., its ca command.

[michalwilk96]

Ok, so I'm trying to generate key-pair using OQS curl with openssl using kyber1024 exchange algo and I'm getting an error.
Command:
docker run -vpwd:/opt/tmp -it openquantumsafe/curl openssl req -x509 -new -newkey kyber1024 -keyout /opt/tmp/CA.key -out /opt/tmp/CA.crt -nodes -subj "/CN=localhost" -days 365

Error:
489D990140000000:error:1D800065:ENCODER routines:OSSL_ENCODER_to_bio:reason(101):crypto/encode_decode/encoder_lib.c:55:No encoders were found. For standard encoders you need at least one of the default or base providers available. Did you forget to load them? 489D990140000000:error:04800073:PEM routines:do_pk8pkey:error converting private key:crypto/pem/pem_pk8.c:133:

Next I wanted to use dilithium5 for server and client cert generation. But CA generation stopped me with above issue.
Thank you for the help.

[baentsch]

This very much looks like the (oqs)provider has not been loaded. You may want to consider using a pre-built image ensuring this is correctly set up -- simple to validate by running openssl list -signature-algorithms.