I'd probably suggest you to consider creating a CA and signing each user certificate using the CA or its Intermediate CAs as this would assure that the user is really the user you have trusted and not someone else in the middle who you trust each time a connection establishes. And another advantage: You just gotta trust the root certificate and all users will be trusted then.

I don't know very much of XAMPP, but you should also lookup for ways to implement a Forward Secrecy. In TLS connections, this is dealt using DH Keys (at least 2048 bit to be secure, I go for 4096 dhparam usually, but on a RasPi, I'd advise you to use dsaparam cuz that's faster and said to be as secure as dhparam). That way with each session, a new secret is generated per handshake and even if later on your certificates got compromised, it'd be nearly impossible to decrypt previous messages. You can also check up for which ciphersuits and curves to use to keep things secure at cipherli.st as there are secure ciphers regularly updated,

Also note, generating 8k bits keys does not mean you will really have the strength of the 8k, so don't go over the horizon just to make things "more secure". It always depends on the entropy on the device and e.g. in an old Debian version, there was some kinda "Debian Weak Key Vulnerabilty", so doesn't matter how many bits you set, the keys were always weak, so also keep up your System up to date and use a secure OS that you personally trust. (I personally use BSD to generate keys nowadays since NSA made a commit in the Linux Kernel as far as I know and this commit is said to affect several security points in any Linux Distro. So for obvious reasons, I don't trust the NSA even in open source commits, but won't judge Linus' decision on that tho)

Between, you do not need to manage an own PKI for just a few users, just the self-made openSSL CA would be sufficient enough. But if you wanna go clean, EJBCA is not so bad to manage CAs androlled certificates as well as revocation lists.

Regarding how secure it is.. It is as told above too, nearly as secure as any other certificate unless you use softwares or an OS with vulnerabilities. TBH, I use an own CA and roll my certificates for several things myself and theyre just fine so far (e.g. server certs, user certs, RADIUS cert, SQUID MITM CA).

I'd probably suggest you to consider creating a CA and signing each user certificate using the CA or its Intermediate CAs as this would assure that the user is really the user you have trusted and not someone else in the middle who you trust each time a connection establishes. And another advantage: You just gotta trust the root certificate and all users will be trusted then.

I don't know very much of XAMPP, but you should also lookup for ways to implement a Forward Secrecy. In TLS connections, this is dealt using DH Keys (at least 2048 bit to be secure, I go for 4096 dhparam usually, but on a RasPi, I'd advise you to use dsaparam cuz that's faster and said to be as secure as dhparam). That way with each session, a new secret is generated per handshake and even if later on your certificates got compromised, it'd be nearly impossible to decrypt previous messages. You can also check up for which ciphersuits and curves to use to keep things secure at cipherli.st as there are secure ciphers regularly updated,

Also note, generating 8k bits keys does not mean you will really have the strength of the 8k, so don't go over the horizon just to make things "more secure". It always depends on the entropy on the device and e.g. in an old Debian version, there was some kinda "Debian Weak Key Vulnerabilty", so doesn't matter how many bits you set, the keys were always weak, so also keep up your System up to date and use a secure OS that you personally trust. (I personally use BSD to generate keys nowadays since NSA made a commit in the Linux Kernel as far as I know and this commit is said to affect several security points in any Linux Distro. So for obvious reasons, I don't trust the NSA even in open source commits, but won't judge Linus' decision on that tho)

Between, you do not need to manage an own PKI for just a few users, just the self-made openSSL CA would be sufficient enough. But if you wanna go clean, EJBCA is not so bad to manage CAs androlled certificates as well as revocation lists.