1. cat /tmp/ca.cfg
[DEFAULT]
pki_instance_name = pki-ca-June22
pki_token_password = Secret123
pki_admin_password = Secret123
pki_hostname = localhost
pki_security_domain_name = pki-ca-June22.org
pki_security_domain_password = Secret123
pki_client_dir = /opt/pki-ca-June22
pki_client_pkcs12_password = Secret123
pki_ds_password = Secret123
pki_ds_ldap_port = 389
pki_hsm_enable=True
pki_hsm_libfile=/opt/nfast/toolkits/pkcs11/libcknfast.so
pki_hsm_modulename=nfast
pki_token_name=NHSM6000
pki_token_password=redhat123
pki_audit_signing_token=NHSM6000
pki_subsystem_token=NHSM6000
pki_ssl_server_token=NHSM6000

[CA]
pki_import_admin_cert = False
pki_ds_hostname = localhost
pki_admin_nickname = PKI CA Administrator for Example.Org
pki_ca_signing_token=NHSM6000
pki_ocsp_signing_token=NHSM6000

2. pkispawn -s CA -f /tmp/ca.cfg

[root@nocp4 ~]# pkispawn -s CA -f /tmp/ca.cfg
Log file: /var/log/pki/pki-ca-spawn.20160623094647.log
Loading deployment configuration from /tmp/ca.cfg.
Installing CA into /var/lib/pki/pki-ca-June22-2.
Storing deployment configuration into
/etc/sysconfig/pki/tomcat/pki-ca-June22-2/ca/deployment.cfg.
Module "nfast" added to database.
Enter password for NHSM6000:

Should take the password from pki_token_password=redhat123 in the cfg file