>Assuming you already have a CA nicknamed 'cacert' and your database is
>in the directory named 'foo':
>
>% certutil -R -d foo -s "cn=localhost,dc=example,dc=com" -o tmpcertreq
>-g 1024
>% certutil -C -d foo -c cacert -i tmpcertreq -o tmpcert.der -m 9 -v 12
>-1 -5 -8 foo.example.com
>% certutil -A -d foo -n Alt-Cert -t u,u,u -i tmpcert.der
>% certutil -L -d foo -n Alt-Cert
>% rm -f tmpcert.der tmpcertreq