I have a caocspsigning cert imported from CA to KRA's subsystem db with a trust
"C,,". Exported the certs & keys from KRA's nss db using PKCS12Export and
imported using pk12util to a fresh nss db. The "caocspsigning" cert shows up as
NULL.  Also, the trust bits for "PKI ROOTCA Signing Cert - redhat" and
"kra3auditsigningcert" are not the same after the import.

# certutil -L -d /var/lib/pki/rootkra/alias

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

PKI ROOTCA Signing Cert - redhat                             CT,c,
kra3transportcert                                            u,u,u
Server-Cert cert-pki-RootCA                                  u,u,u
kra3auditsigningcert                                         u,u,Pu
kra3storagecert                                              u,u,u
kra3subsystemcert                                            u,u,u
caocspsigningcert                                            C,,


# PKCS12Export -d /var/lib/pki/rootkra/alias -o KRA_SUBSYSTEM_CERTS -p
./password  -w ./password

# pk12util -d /root/temp12/ -i ./KRA_SUBSYSTEM_CERTS
Enter Password or Pin for "NSS Certificate DB":
Enter password for PKCS12 file:
pk12util: PKCS12 IMPORT SUCCESSFUL

# certutil -L  -d /root/temp12

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

kra3transportcert                                            u,u,u
Server-Cert cert-pki-RootCA                                  u,u,u
kra3auditsigningcert                                         u,u,u
PKI ROOTCA Signing Cert - redhat                             ,,
kra3storagecert                                              u,u,u
kra3subsystemcert                                            u,u,u
(NULL)                                                       ,,