Create a server certificate issued by own Certificate Authority

Create a server certificate that will be issued by the Certificate Authority (CA) that you control.

In the example below, you use the -C (certificate) request option. The -i option specifies the name and path of the request file (in this scenario, "tmpcertreq"). You create the server certificate issued by our CA in our token using options -c myicatoken:testca.
In this scenario, "myicatoken" is the name used for the ica token, and "testca" is the name used for the self-signed CA server certificate. The password entered here is the user PIN of the ICA token (which was set in Step 7 of topic Configuring the openCryptoki ica token). For our server certificate tmpcert.der enter:
```
# certutil -C -d /etc/httpd/nss -c myicatoken:testca -i /etc/httpd/nss/tmpcertreq -o 
      /etc/httpd/nss/tmpcert.der -m 5556 -v 48 -1 -5
Enter Password or Pin for "myicatoken": 25345867
```

Select option 2 (Key encipherment) as shown below:

  0 - Digital Signature
  1 - Non-repudiation
  2 - Key encipherment
  3 - Data encipherment
  4 - Key agreement
  5 - Cert signing key
  6 - CRL signing key
  Other to finish
 > 2

Select option 9 (Other to finish) as shown below:

  0 - Digital Signature
  1 - Non-repudiation
  2 - Key encipherment
  3 - Data encipherment
  4 - Key agreement
  5 - Cert signing key
  6 - CRL signing key
  Other to finish
 > 9

Select option n as shown below:
```
Is this a critical extension [y/N]?
n
```

Select option 1 (SSL Server) as shown below:

  0 - SSL Client
  1 - SSL Server
  2 - S/MIME
  3 - Object Signing
  4 - Reserved for future use
  5 - SSL CA
  6 - S/MIME CA
  7 - Object Signing CA
  Other to finish
 > 1

Select option 9 (Other to finish) as shown below:

  0 - SSL Client
  1 - SSL Server
  2 - S/MIME
  3 - Object Signing
  4 - Reserved for future use
  5 - SSL CA
  6 - S/MIME CA
  7 - Object Signing CA
  Other to finish
 > 9

Select option n as shown below:
```
Is this a critical extension [y/N]?
n 
```

On completion of the above steps, the self-signed certificate testca is now stored in the nss database.