proofpoint-quarantine-portal/certs

Client certificate (mutual TLS)

A self-signed client certificate for the PoC, used when PPS/nginx requires a client cert (otherwise requests fail with 400 No required SSL certificate was sent).

File	What it is	Where it goes
client.crt	Public certificate	Upload to PPS (System > Certificates > Client Certificates)
client.key	Private key (secret)	Stays with this app only — gitignored
client.pem	Combined cert + key	Referenced by config.toml client_cert

config.toml points client_cert at certs/client.pem (combined, so client_key is left empty). The app presents this cert on every PPS request.

Regenerate

openssl req -x509 -newkey rsa:2048 -keyout certs/client.key -out certs/client.crt \
  -days 3650 -nodes -subj "/CN=pps-quarantine-poc-client/O=PPS Quarantine PoC" \
  -addext "extendedKeyUsage=clientAuth" -addext "keyUsage=critical,digitalSignature"
cat certs/client.crt certs/client.key > certs/client.pem
chmod 600 certs/client.key certs/client.pem

Self-signed is fine for a PoC: PPS/nginx trusts the uploaded client.crt directly as its own CA. Not for production.