How do you generate self-signed certificate for a Windows universal forwarder?

We have a requirement to enable TLS on traffic from a universal forwarder (UF) to a heavy forwarder. We will be using self-signed certificates for this. From the following Splunk documentation, we understand how to generate and apply certificates for heavy forwarders. We are not clear on how to generate certificates for UF (client.pem). Splunk Universal Forwarder - v6.1.7.1 Splunk Enterprise - v6.6.5 Can you please point me in the right direction for generating client certificates. https://docs.splunk.com/Documentation/Splunk/7.2.0/Security/Howtoself-signcertificates http://docs.splunk.com/Documentation/Splunk/7.2.0/Security/HowtoprepareyoursignedcertificatesforSplunk http://docs.splunk.com/Documentation/Splunk/7.2.0/Security/ConfigureSplunkforwardingtousesignedcertificates