The D1 MN cert, which allows the MN to start outgoing connections to the CNs and other MNs. -->Issued by D1 and transferred to the MN operator through a secure channel.
The MN client cert, which can be issued to clients to allow them to connect to the MN and create objects there.-->Issued by the MN and transferred to clients.
The MN server certificate, which allows the MN to identify itself when it receives calls from the client. -->Issued by a 3rd party certificate authority (CA), such as Let's Encrypt (free), or a paid one, such as Verisign.
