Creating Self Signed CA Signing Certificate with PKI CLI

Issuing a Certificate

To issue a certificate, prepare a certificate extension configuration in a file (e.g. ca_signing.conf):

basicConstraints       = critical, CA:TRUE
subjectKeyIdentifier   = hash
keyUsage               = critical, digitalSignature, keyCertSign, cRLSign

# authorityInfoAccess    = OCSP;URI:http://ocsp.example.com, caIssuers;URI:http://cert.example.com

# certificatePolicies    = 2.23.140.1.2.1, @cps_policy
# cps_policy.id          = 1.3.6.1.4.1.44947.1.1.1
# cps_policy.CPS.1       = http://cps.example.com

To issue a self-signed certificate:

$ pki nss-cert-request \
    --subject "CN=CA Signing Certificate" \
    --ext ca_signing.conf \
    --csr ca_signing.csr
$ pki nss-cert-issue \
    --csr ca_signing.csr \
    --ext ca_signing.conf \
    --cert ca_signing.crt

Availability: PKI 10.9

See Also

• Generating System Certificates

• Generating CA Signing Certificate

• PKI NSS CLI