Issuing Subsystem Certificate with PKI NSS - dogtagpki/pki GitHub Wiki
To issue a certificate, prepare a certificate extension configuration in a file (e.g. subsystem.conf):
authorityKeyIdentifier = keyid:always keyUsage = critical, digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment extendedKeyUsage = clientAuth
To issue a certificate signed by a CA certificate, specify the CA certificate nickname:
$ pki nss-cert-issue \ --issuer ca_signing \ --csr subsystem.csr \ --ext subsystem.conf \ --cert subsystem.crt
Availability: PKI 10.9