Skip to content

Issuing Audit Signing Certificate with NSS

Endi S. Dewata edited this page Dec 4, 2020 · 4 revisions

Overview

This page describes the process to sign the audit signing CSR and issue the certificate using NSS.

This page assumes an NSS database has been created as follows:

$ echo Secret.123 > password.txt
$ openssl rand -out noise.bin 2048
$ mkdir nssdb
$ certutil -N -d nssdb -f password.txt

It also assumes a CA signing certificate is present in the NSS database.

Issuing Certificate

Sign the CSR with the CA signing certificate with the following commands:

$ CA_SKID=...
$ OCSP=...
$ echo -e "y\n\ny\ny\n${CA_SKID}\n\n\n\n2\n7\n${OCSP}\n\n\n\n" | \
   certutil -C \
   -d nssdb \
   -f password.txt \
   -m $RANDOM \
   -a \
   -i audit_signing.csr \
   -o audit_signing.crt \
   -c "ca_signing" \
   -3 \
   --extAIA \
   --keyUsage critical,digitalSignature,nonRepudiation

It will generate the audit signing certificate in audit_signing.crt.

See Also

Clone this wiki locally