Since clientca.pem is created and managed by your own systems or your service provider, the "download" process is a controlled operation. There are three legitimate sources:
If you are setting up a server (e.g., a MongoDB instance, a Kubernetes cluster, or a custom API) and you want to enforce client authentication, you do not download the file—you generate it. clientca.pem download