I'm currently working on a project that includes client-authorization using client certificates, where my app is the Certificate Authority. Doing that, every user that registers to my web server gets a p12 signed certificate issued especially to his username as common-name. Currently the app signs every CSR it gets, only if the CN is not in the users database.
Am I exposed to potential risk doing so? Can the client abuse it somehow? Do I need to check more carefully the PKCS12 parameters?