Description of problem:
When an error occurs with certutil, stderr output from it is not printed:

[root@fedora ~]# dsctl localhost tls generate-server-cert-csr -s "bad" 
Error: Command '['/usr/bin/certutil', '-R', '--keyUsage', 'digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment', '--nsCertType', 'sslClient,sslServer', '--extKeyUsage', 'clientAuth,serverAuth', '-s', 'bad', '-8', 'fedora', '-g', '4096', '-d', '/etc/dirsrv/slapd-localhost', '-z', '/etc/dirsrv/slapd-localhost/noise.txt', '-f', '/etc/dirsrv/slapd-localhost/pwdfile.txt', '-a', '-o', '/etc/dirsrv/slapd-localhost/Server-Cert.csr']' returned non-zero exit status 255.

It just states that the exit status is 255, but no certutil output, which in this case is

certutil -s: improperly formatted name: "bad"

In lib389/nss_ssl.py we have many places with statements like this that show this behaviour:

        result = ensure_str(check_output(cmd, stderr=subprocess.STDOUT))
        self.log.debug("nss output: %s", result)


Version-Release number of selected component (if applicable):
8.x

How reproducible:
systematic

Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: