Passwort: 
linux-616f:~ # cd /home/Username
linux-616f:/home/Username # ./make-certs Leap15.1 all codesign 1.3.6.1.4.1.311.10.3.1                   You already have a ca.srl file; not replacing.
You already have a ca.db file; not replacing.
You already have a ca.db.attr file; not replacing.
You already have a ca.key file; not replacing.
You already have a ca.crt file; not replacing.
You already have an ocsp.key file; not replacing.
You already have an ocsp.crt file; not replacing.
Using configuration from /home/Username/openssl.cnf
You already have a Leap15.1.crt file; not replacing.
You already have a ca.pem file; not replacing.
You already have a Leap15.1.pem file; not replacing.
You already have a Leap15.1.p12 file; not replacing.

CA certificate:
issuer=C  US, L  SomeCity, O  SomeOrg
subject=C  US, L  SomeCity, O  SomeOrg

End entity certificate:
issuer=C  US, L  SomeCity, O  SomeOrg
subject=C  US, L  SomeCity, O  SomeOrg, CN  Leap15.1
serial 01

PKCS12 bag:
Enter Import Password:
MAC:sha1 Iteration 2048
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048

Verifying:
+ openssl verify -CAfile ca.chain.crt Leap15.1.crt
Leap15.1.crt: OK
linux-616f:/home/Username # mkdir certdb
mkdir: cannot create directory ‘certdb’: File exists
linux-616f:/home/Username # certutil -N -d certdb
Enter Password or Pin for "NSS Certificate DB":
Enter a password which will be used to encrypt your keys.
The password should be at least 8 characters long,
and should contain at least one non-alphabetic character.

Enter new password: 
Re-enter password: 
Password changed successfully.
linux-616f:/home/Username # certutil -L -d certdb

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

linux-616f:/home/Username # certutil -A -n 'my CA' -d certdb -t CT,CT,CT -i ca.crt
linux-616f:/home/Username # pk12util -d certdb -i Leap15.1.p12
Enter password for PKCS12 file: 
pk12util: PKCS12 IMPORT SUCCESSFUL
linux-616f:/home/Username # certutil -d certdb -A -i Leap15.1.crt -n "Leap15.1" -t u
Notice: Trust flag u is set automatically if the private key is present.
linux-616f:/home/Username # certutil -L -d certdb

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

my CA                                                        CT,C,C
Leap15.1                                                     u,u,u
linux-616f:/home/Username # pesign -n certdb -c "Leap15.1" -s -i sample.efi -o sample-signed.efi