pkispawn -s CA -f subca.cfg Here's a sample config file: [DEFAULT] pki_admin_password=password123 pki_client_database_password=password123 pki_client_pkcs12_password=password123 pki_ds_password=password123 pki_security_domain_password=password123 pki_security_domain_hostname=dogtag.example.com pki_security_domain_https_port=8443 pki_security_domain_user=caadmin pki_ajp_port=8010 pki_tomcat_server_port=8006 pki_https_port=8453 pki_http_port=8090 pki_instance_name=pki-subca [CA] pki_subordinate=True pki_issuing_ca=https://dogtag.example.com:8443 pki_ca_signing_subject_dn=cn=subca signing, o=example.com Some notes: 1. The issuing CA and security domain port settings are for the root CA. 2. The other port settings and the pki_instance_name are set because I installed the sub CA on the same host as the root CA. You can take the defaults on these if the subCA is on a different host. On Fri, 2014-12-19 at 15:04 +1000, Fraser Tweedale wrote: