Using caDualCert Profile - dogtagpki/pki GitHub Wiki
This certificate profile is for enrolling dual user certificates. It only works with Netscape 7.0 or later.
$ pki client-cert-request uid=testuser \ --profile caDualCert \ --type crmf \ --transport transport.pem