# # certtool --generate-privkey --key-type=mldsa65 > cakey.pem
Generating an ML-DSA-65 private key...
# cat > ca.info
cn = Name of your organization
ca
cert_signing_key
# certtool --generate-self-signed --load-privkey cakey.pem \
  --template ca.info --outfile cacert.pem
Generating a self signed certificate...
X.509 Certificate Information:
    Version: 3
    Serial Number (hex): 5959832524ad6a36692163bbd568f293e02a8183
    Validity:
        Not Before: Tue Aug 05 08:19:52 UTC 2025
        Not After: Wed Aug 05 08:19:52 UTC 2026
    Subject: CN=Name of your organization
    Subject Public Key Algorithm: ML-DSA-65
    Algorithm Security Level: Future (15616 bits)
    Extensions:
        Basic Constraints (critical):
            Certificate Authority (CA): TRUE
        Key Usage (critical):
            Certificate signing.
        Subject Key Identifier (not critical):
            b5c6522df90bee6cd7c4c583dbe1a5f8961d90a2
Other Information:
    Public Key ID:
        sha1:b5c6522df90bee6cd7c4c583dbe1a5f8961d90a2
        sha256:714c9a6c9192fc97cf711a66e9256f72be00e905f4c2766b0120e060e968a577
    Public Key PIN:
        pin-sha256:cUyabJGS/JfPcRpm6SVvcr4A6QX0wnZrASDgYOlopXc=

 

Signing certificate...

# certtool -i --infile cacert.pem 
X.509 Certificate Information:
    Version: 3
    Serial Number (hex): 5959832524ad6a36692163bbd568f293e02a8183
    Issuer: CN=Name of your organization
    Validity:
        Not Before: Tue Aug 05 08:19:52 UTC 2025
        Not After: Wed Aug 05 08:19:52 UTC 2026
    Subject: CN=Name of your organization
    Subject Public Key Algorithm: ML-DSA-65
    Algorithm Security Level: Future (15616 bits)
    Extensions:
        Basic Constraints (critical):
            Certificate Authority (CA): TRUE
        Key Usage (critical):
            Certificate signing.
        Subject Key Identifier (not critical):
            b5c6522df90bee6cd7c4c583dbe1a5f8961d90a2
    Signature Algorithm: ML-DSA-65
warning: signed using a broken signature algorithm that can be forged.
    Signature:
        5c:39:36:24:47:92:e1:87:ce:01:5e:71:50:0b:c8:ef
...snip....