+
+ROOTCMD=""
+# Insecure CA is OK for development, and if the CA is in afs it is
+# assumed the script is being run with sufficient
+# permissions. Otherwise, become root to use the ca private key,
+if [ ! -r $CACONF ]; then
+ ROOTCMD=sudo
+fi
+
+$ROOTCMD openssl ca -batch -config `domtool-config -path cert ca`/domtool-openssl.conf -out $NEWCERT -infiles $NEW
+$ROOTCMD chown `whoami` $NEWCERT
+mv $NEWCERT $CERTFILE