Function issue_user_cert 

pub fn issue_user_cert(
    ca_cert_pem: &str,
    ca_key_pem: &str,
    cn: &str,
    validity_days: u32,
) -> Result<UserCert, CaError>

Sign a leaf client cert with Subject = CN=<cn>.

The subject is a bare RDN. This matches Strimzi and avoids the RFC 2253 against 4514 ordering ambiguity. The cert carries ExtendedKeyUsage = clientAuth and KeyUsage = digitalSignature|keyEncipherment. The key is ECDSA P-256.

Errors

Returns an error when credentials or key material are invalid, cryptographic verification fails, or the TLS, SASL, or Kerberos exchange is rejected.