2.10. Using a private CA to issue certificates for CSRs with GnuTLS

Procedure

1. Optional: Use a text editor of your choice to prepare an GnuTLS configuration file for adding extensions to certificates, for example:

   $ vi <server_extensions.cfg>
   honor_crq_extensions
   ocsp_uri = "http://ocsp.example.com"

2. Use the certtool utility to create a certificate based on a CSR, for example:

   $ certtool --generate-certificate --load-request <example_server.crq> --load-ca-privkey <ca.key> --load-ca-certificate <ca.crt> --template <server_extensions.cfg> --outfile <example_server.crt>