TLS Setup Documentation

> You need to set the path to the server's X509 certificate by setting the ssl_cert system variable.

Where does the server's X509 certificate come from? A guide like [1] suggests the admin can generate it himself. IMO this info should be included in the MariaDB docs.
Could a script be provided that automates all steps?

1. https://www.cyberciti.biz/faq/how-to-setup-mariadb-ssl-and-secure-connections-from-clients/

2. https://mariadb.com/kb/en/library/securing-connections-for-client-and-server/