$ keytool \
    -gencert \
    -keystore ca_signing.p12 \
    -storetype pkcs12 \
    -storepass Secret.123 \
    -alias ca_signing \
    -ext KeyUsage:c=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment \
    -ext ExtendedKeyUsage=serverAuth \
    -rfc \
    -infile sslserver.csr \
    -outfile sslserver.crt