Generating OCSP Signing CSR with PKI NSS - dogtagpki/pki GitHub Wiki
To create a certificate request, prepare a certificate extension configuration (e.g. ocsp_signing.conf):
authorityKeyIdentifier = keyid:always extendedKeyUsage = OCSPSigning noCheck = ignored
Then execute the following command:
$ pki nss-cert-request \ --subject "CN=OCSP Signing Certificate" \ --ext ocsp_signing.conf \ --csr ocsp_signing.csr
Availability: PKI 10.10