Yep. That's my preferred solution, obviously ;)

Certs have "TLS Client Authentication" key use set by default.