the realm; the ambient realm when absent
kind ('person' or 'application'), username or
application, keyAlg, label, email (a person's, for an
rfc822Name) and days
{ ok: true, issued } with the certificate, chain and key pair,
or { ok: false, errors } marked with its code
Issues a TLS client certificate carrying clientAuth to a person or an application, from the realm's
tls-clientIssuing CA.The caller has already decided who. The private key is handed back once and not kept; expired records of the holder are forgotten first, and a person's issue raises a CAEP credential-change event.