Currently to clone a subsystem the subsystem certs/keys have to be exported from the master's NSS database into a PKCS #12 file, and then imported into the clone's NSS database. The export step is done using PKCS12Export. See: https://access.redhat.com/documentation/en-US/Red_Hat_Certificate_System/8.1/html/Deploy_and_Install_Guide/exporting-keys.html.

Using PKCS12Export to export subsystem certs/keys has some issues:
1. If a certificate has been renewed, it will exports both the old and the new certificates. An expired certificates may cause import problems (see ticket #1093).
2. If the subsystem is sharing an instance with other subsystems, the tool will export the certs/keys from the other subsystems too. This may become a problem if the clone is not meant to be sharing with the other subsystems.

Issue #1 can be fixed by validating the certs during export, but issue #2 is more difficult to fix. The PKCS12Export is a generic tool, it's not aware of Dogtag subsystems. However, to fix issue #2 the tool has to know which certs/keys belong to a particular subsystem. That information exists in the CS.cfg of the subsystem, so the tool needs to know how to read CS.cfg and read the right parameters.

A possible solution is to create a new server management tool that can be run only by root just like pkispawn/pkidestroy:

$ pki-server -i pki-tomcat ca-cert-find \
    --valid-certs \
    --pkcs12-file ca-certs.p12 \
    --pkcs12-password password.txt

The above command will export valid CA subsystem certs/keys from the instance's NSS database into a PKCS #12 with the provided password. The command can be expanded to manage other aspects of the server.

Proposed milestone: 10.3