A certificate signed by a trusted root CA will work, but is unnecessary. A self-signed certificate can be created for free, with OpenSSL. If a client certificate is self-signed, ircd will only verify that it is not expired. If the client certificate is not self-signed, then it must verify completely, as openssl verify would do. … Continue reading Creating an SSL Certificate