Develop a resource that converts an existing client.pem setup to one capable of MTLS

As a Chef administrator
I would like a way to programmatically setup nodes to use MTLS
so that I can migrate existing systems to MTLS using Chef

Currently, we have the ability to enable cert validation on the Infra Server and we have the ability to use the cert chain on the client, but we don't have a way to get existing clients setup for MTLS communication. We need to provide users with the tools in chef recipes to setup the x509 cert/pem files given their existing client.pem and a CA cert.

Potential Look / Feel

This should be considered a high level idea. Change what you need.

chef_client_mtls_cert_migration 'setup node mtls certs' do
  ca_cert 'ABC123_I_AM_CERT_STRING'
end

Requirements

• Resource is marked sensitive to prevent logs from containing the cert contents
• takes ca cert either as string or as path on disk
• has a property for specifying the client.pem location which defaults to the right location based on OS as determined by chef-config
• Outputs cert and key to the default location

Start by reviewing Chef recipes and chef-config's OS-specific defaults for the existing client.pem location, then determine how the proposed resource should accept a CA certificate as a string or disk path. Done means a sensitive resource can migrate existing clients, write the certificate and key to their default locations, and support a configurable client.pem path.