Actually creating client side certificates is quite easy if you use the &lt;keygen&gt; tag. See <a href="http:&#x2F;&#x2F;www.w3.org&#x2F;2005&#x2F;Incubator&#x2F;webid&#x2F;spec&#x2F;tls&#x2F;#certificate-creation" rel="nofollow">http:&#x2F;&#x2F;www.w3.org&#x2F;2005&#x2F;Incubator&#x2F;webid&#x2F;spec&#x2F;tls&#x2F;#certificate...</a>
Sadly some browser vendors have been threatening to remove that functionality rather than trying to improve it. But see the work by the Technical Architecture Group There is also this document now produced by the TAG.
<a href="https:&#x2F;&#x2F;github.com&#x2F;w3ctag&#x2F;client-certificates" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;w3ctag&#x2F;client-certificates</a>