Issuing Audit Signing Certificate with PKI NSS - dogtagpki/pki GitHub Wiki
To issue a certificate, prepare a certificate extension configuration in a file (e.g. audit_signing.conf):
authorityKeyIdentifier = keyid:always keyUsage = critical, digitalSignature, nonRepudiation
To issue a certificate signed by a CA certificate, specify the CA certificate nickname:
$ pki nss-cert-issue \ --issuer ca_signing \ --csr audit_signing.csr \ --ext audit_signing.conf \ --cert audit_signing.crt
Availability: PKI 10.9