Issuing Admin Certificate with NSS

Overview

This page describes the process to sign the admin CSR and issue the certificate using NSS.

This page assumes an NSS database has been created as follows:

$ echo Secret.123 > password.txt
$ openssl rand -out noise.bin 2048
$ mkdir nssdb
$ certutil -N -d nssdb -f password.txt

It also assumes a CA signing certificate is present in the NSS database.

Issuing Admin Certificate

Sign the CSR with the CA signing certificate with the following commands:

$ CA_SKID=...
$ OCSP=...
$ echo -e "y\n\ny\ny\n${CA_SKID}\n\n\n\n2\n7\n${OCSP}\n\n\n\n" | \
   certutil -C \
   -d nssdb \
   -f password.txt \
   -m $RANDOM \
   -a \
   -i admin.csr \
   -o admin.crt \
   -c "ca_signing" \
   -3 \
   --extAIA \
   --keyUsage critical,dataEncipherment,keyEncipherment,digitalSignature,nonRepudiation \
   --extKeyUsage clientAuth,emailProtection

It will generate the admin certificate in admin.crt.

See Also

• Generating Admin Certificate

• Generating Admin CSR with NSS

• Issuing CA Signing Certificate with NSS