3.a. Generating client certificates using the CSR flow
This is an most straight-forward way of generating client certificates, but it can expose the server to unwanted connections during it's "deployment mode" phase. Please make sure you turn of the deployment mode after all client machines have successfully connected the first time.