I posted a similar question on the NSS newsgroup and asked about usage of certutil documented in the RH DS Admin Guide. The response I got is that step 5 in section "using certutil" is a no-op. For detail, please see <a href="http://groups.google.com/group/mozilla.dev.tech.crypto/browse_thread/thread/ae13056d51d189ac">http://groups.google.com/group/mozilla.dev.tech.crypto/browse_thread/thread/ae13056d51d189ac</a> - David <div class="gmail_quote">On Tue, Apr 8, 2008 at 3:50 PM, Rich Megginson <<a href="mailto:rmeggins@redhat.com">rmeggins@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> <div class="Ih2E3d"><a href="mailto:ggistra@aol.com" target="_blank">ggistra@aol.com</a> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Step 5 in section "Using certutil" of the The Directory Server Administrator's Guide 7.1, Chapter 11, generates "the encryption key" using the -G option. According to the certutil documentation, this generates a public/private key pair. </blockquote></div> I think it's the encryption key for the self signed CA you are creating. <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> /What is this key pair used for?/ It doesn't seem to be the key used for the self-signed ceritficate or the server certificate, as the -S switch on certutil - judging by the available options for -S - appears to generate a new key pair. Thanks, Gabi ------------------------------------------------------------------------ Get the MapQuest Toolbar <<a href="http://www.mapquest.com/toolbar?NCID=mpqmap00030000000003" target="_blank">http://www.mapquest.com/toolbar?NCID=mpqmap00030000000003</a>>, Maps, Traffic, Directions & More! ------------------------------------------------------------------------ -- Fedora-directory-users mailing list <a href="mailto:Fedora-directory-users@redhat.com" target="_blank">Fedora-directory-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/fedora-directory-users" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-directory-users</a> </blockquote> -- Fedora-directory-users mailing list <a href="mailto:Fedora-directory-users@redhat.com">Fedora-directory-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/fedora-directory-users" target="_blank">https://www.redhat.com/mailman/listinfo/fedora-directory-users</a> </blockquote></div>