Issuing OCSP Signing Certificate with PKI NSS - dogtagpki/pki GitHub Wiki
To issue a certificate, prepare a certificate extension configuration in a file (e.g. ocsp_signing.conf):
authorityKeyIdentifier = keyid:always extendedKeyUsage = OCSPSigning noCheck = ignored
To issue a certificate signed by a CA certificate, specify the CA certificate nickname:
$ pki nss-cert-issue \ --issuer ca_signing \ --csr ocsp_signing.csr \ --ext ocsp_signing.conf \ --cert ocsp_signing.crt
Availability: PKI 10.10