- signsub.sh to sign a sub CA with the root CA - signclient.sh to sign client certificates with the Sub CA - signserver.sh to sign server certificates with the Sub CA