How do I generate Client certificates from my PrivateCA with the CommonName as their email address?

No, not 802.1x - but very similar. Also, we don't use Windows Server in any of this infrastructure. Are you suggesting this cannot be managed in AWS at all?

To generate client certificates from your AWS Private CA with the CommonName as the email address, you can use the AWS Private CA API or CLI, specifically the IssueCertificate action. Here's how you can approach this:

1. Use a certificate template that allows for customization of the Subject Name. The "EndEntityCertificate/V1" template is typically used for this purpose.

2. When calling the IssueCertificate action, you'll need to provide a Certificate Signing Request (CSR) that includes the email address as the Common Name.

3. You can generate these CSRs programmatically for each user, ensuring that each CSR has the user's email address as the Common Name.

4. Use the AWS CLI or an AWS SDK to automate the process of issuing certificates for multiple users.

Here's a general outline of the process:

1. Generate a key pair for each user.
2. Create a CSR for each user, setting the Common Name to their email address.
3. Use the AWS CLI or SDK to call the IssueCertificate action for each CSR.
4. Retrieve and distribute the issued certificates.

Regarding your secondary question about the file formats: When you download the certificates, you typically get the certificate itself (often with a .pem or .crt extension), the private key (usually .key), and potentially the certificate chain. To create a PFX (PKCS#12) file that includes both the certificate and private key for distribution to Windows clients, you would need to combine these files using a tool like OpenSSL.

For managing this process at scale, consider creating a script or small application that automates these steps, possibly integrating with your user management system to retrieve email addresses and distribute certificates securely.
Sources
Use AWS Private CA certificate templates - AWS Private Certificate Authority
CertificateAuthorityConfiguration - AWS Private Certificate Authority
Create a client certificate using your CA certificate - AWS IoT Core

Sounds like your using 802.1x with your Radius. I had set this up a long time ago and actually used Windows to do this https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/deploy-server-certificates-for-802.1x-wired-and-wireless-deployments

My apologies, I did not realise this falls into 802.1x. See here the RADIUS server is provided by JumpCloud and note that the user's email must be in either the subject alternative name, subject distinguished name, or the username in the common name. This is what I'm struggling to achieve in AWS - it seems the CN is set in the CA, you cannot change that. I can achieve this using their own scripts - which you will note uses OpenSSL. I can also achieve this using EasyRSA - the only problem with this is managing 50 odd users at scale - I am having to generate each cert one at a time and I worry that when these come to expire, I will need to be notified and have to regenerate new ones (as well as deploy, globally) - so I was hoping AWS Certificate Manager was the answer to my prayers.