diff --git a/signclient.sh b/signclient.sh
new file mode 100644
index 0000000..084fc24
--- /dev/null
+++ b/signclient.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [ $# -lt 1 ]; then
+    echo "Usage: $0 <client-csr.csr.pem>"
+    exit 1
+fi
+
+openssl ca -config subca.conf -in "$1" -out "${1%%.csr.pem}.crt.pem" -extensions client_cert
diff --git a/signserver.sh b/signserver.sh
new file mode 100644
index 0000000..23ffb60
--- /dev/null
+++ b/signserver.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [ $# -lt 1 ]; then
+    echo "Usage: $0 <server-csr.csr.pem>"
+    exit 1
+fi
+
+openssl ca -config subca.conf -in "$1" -out "${1%%.csr.pem}.crt.pem" -extensions server_cert
diff --git a/signsub.sh b/signsub.sh
new file mode 100644
index 0000000..7beadf4
--- /dev/null
+++ b/signsub.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [ $# -lt 1 ]; then
+    echo "Usage: $0 <subca-request.csr.pem>"
+    exit 1
+fi
+
+openssl ca -config rootca.conf -in "$1" -out "${1%%.csr.pem}.crt.pem"