document how to convert key to pkcs12 file

src/ocserv-args.def

@@ -604,7 +604,12 @@ and they will send you the server certificate.
 
 @subheading Generating the client certificates
 Note that it is recommended to leave detailed personal information out of the
-certificate as it is sent in clear during TLS authentication.
+certificate as it is sent in clear during TLS authentication. The following
+process generates a certificate and converts it to PKCS #12 that is protected
+by a PIN and most clients are able to import (the cipher arcfour is used in
+the example because although weak, it is supported by far more devices than
+AES).
+
 @example
 $ certtool --generate-privkey --outfile user-key.pem
 $ cat << _EOF_ >user.tmpl
@@ -619,6 +624,11 @@ $ certtool --generate-certificate --load-privkey user-key.pem \
 	--load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem \
 	--template user.tmpl --outfile user-cert.pem
 
+$ certtool --to-p12 --load-privkey user-key.pem \
+	--pkcs-cipher arcfour \
+	--load-certificate user-cert.pem \
+	--outfile user.p12
+
 @end example
 
 @subheading Revoking a client certificate