diff --git a/doc/radosgw/config.rst b/doc/radosgw/config.rst
index 0c3b22a0fd4..9db01f808b6 100644
--- a/doc/radosgw/config.rst
+++ b/doc/radosgw/config.rst
@@ -369,7 +369,7 @@ Keystone uses for creating the requests to the nss db format, for example::
 	openssl x509 -in /etc/keystone/ssl/certs/ca.pem -pubkey | \
 		certutil -d /var/ceph/nss -A -n ca -t "TCu,Cu,Tuw"
 	openssl x509 -in /etc/keystone/ssl/certs/signing_cert.pem -pubkey | \
-		certutil -d /var/ceph/nss -A -n signing_cert -t "TCu,Cu,Tuw"
+		certutil -A -d /var/ceph/nss -n signing_cert -t "P,P,P"
 
 
 Enabling Subdomain S3 Calls