# Generate the client key and CSR locally, the key is never sent to Vault
openssl req \
    -newkey rsa:4096 \
    -keyout client_key.pem \
    -noenc \
    -subj "/CN=test-client" \
    -out client.csr

# Sign the client CSR
vault write -field=certificate pki_int/sign/wif-client \
    csr=@client.csr \
    common_name=test-client \
    ttl=8760h > client_cert.pem