# Client certificate (mutual TLS)

A self-signed client certificate for the PoC, used when PPS/nginx requires a client
cert (otherwise requests fail with `400 No required SSL certificate was sent`).

| File          | What it is                        | Where it goes                              |
|---------------|-----------------------------------|--------------------------------------------|
| `client.crt`  | Public certificate                | **Upload to PPS** (System > Certificates > Client Certificates) |
| `client.key`  | Private key (secret)              | Stays with this app only — gitignored       |
| `client.pem`  | Combined cert + key               | Referenced by `config.toml` `client_cert`   |

`config.toml` points `client_cert` at `certs/client.pem` (combined, so `client_key` is
left empty). The app presents this cert on every PPS request.

## Regenerate

```bash
openssl req -x509 -newkey rsa:2048 -keyout certs/client.key -out certs/client.crt \
  -days 3650 -nodes -subj "/CN=pps-quarantine-poc-client/O=PPS Quarantine PoC" \
  -addext "extendedKeyUsage=clientAuth" -addext "keyUsage=critical,digitalSignature"
cat certs/client.crt certs/client.key > certs/client.pem
chmod 600 certs/client.key certs/client.pem
```

Self-signed is fine for a PoC: PPS/nginx trusts the uploaded `client.crt` directly as its
own CA. Not for production.