Function generate_clients_ca 

pub fn generate_clients_ca(
    cn: &str,
    validity_days: u32,
) -> Result<CaMaterial, CaError>

Generate a self-signed clients CA with Subject = CN=<cn>, O=krabka, BasicConstraints: CA:TRUE, and KeyUsage = keyCertSign|cRLSign. ECDSA P-256.

Errors

Returns an error when credentials or key material are invalid, cryptographic verification fails, or the TLS, SASL, or Kerberos exchange is rejected.