Authenticating code securely and generating a certificate
My question is how do I authenticate my App to the CA, to prevent something else to request these Client Certificates?


There is generally no way to authenticate the client code. Any secret you embed in the app could be extracted. You must assume an attacker can send requests that an authentic client would.

Instead, what you can do is authenticate the user. You can give each legitimate user a secret license key and only allow a single client certificate to be signed per valid license key. (Probably with the ability to reset for reinstall, etc.)

As an example, such a scheme could look like:


User buys app, downloads client and receives a license key.
App asks user for license key. Sends a certificate-signing request to server that proves the license key.
Server verifies the license key is valid and unused, signs certificate, stores the fact that it is now used.


The certificate signing request could be e.g. licence_key||certificate encrypted with the server's public key (which is embedded in the app). As long as an attacker cannot generate valid license keys on their own, they cannot get extra certificates signed.