# Can I create client certificates for a received LetsEncrypt certificate?

**URL:** <https://community.letsencrypt.org/t/can-i-create-client-certificates-for-a-received-letsencrypt-certificate/78627>\
**Category:** Help\
**Created:** [November 27, 2018, 8:40pm UTC](https://community.letsencrypt.org/t/can-i-create-client-certificates-for-a-received-letsencrypt-certificate/78627 "2018-11-27T20:40:31Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [November 27, 2018, 8:56pm UTC](https://community.letsencrypt.org/t/can-i-create-client-certificates-for-a-received-letsencrypt-certificate/78627/2 "2018-11-27T20:56:32Z")

</div>

Hi,

> [@ogogon](#):
>
> Can I create client certificates for it to authorize technical connections to remote units of my system?

Technically, yes....  
The certificate policy does include client authentication..

However, depending on your limit of authentication level (e.g. verify CA, verify intermediate CA, verify hostname (cn) ), you might not want to use a trusted CA / intermediate CA with the authentication....  
Because if you misconfigured the system, all persons / servers with an Let's Encrypt certificate (or much worse, A DST issued certificate) could pass the validation.

It's much more better to generate a private CA (and intermediate CA as well as client certificate) to use with authentication.

For now, the best (and complete) guide to this is

> **[OpenSSL Certificate Authority — Jamie Nguyen](https://jamielinux.com/docs/openssl-certificate-authority/)**
>
> This guide demonstrates how to act as your own certificate authority (CA) using the OpenSSL command-line tools.

Thank you

---

_[View the full topic](https://community.letsencrypt.org/t/can-i-create-client-certificates-for-a-received-letsencrypt-certificate/78627)._