This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/3056

Endi proposed that we should improve instructions to generate certificate to be more simple (shorter). Might be good if reviewed by native speaker.

{{{
1. Create a certificate database or use an existing one. To create a
   new database:
   # certutil -N -d <database path>
   See certutil documentation for more info.
2. Create a CSR with subject "CN=<hostname>,O=<realm>", for example:
   # certutil -R -d <database path> -a -g <key size>
     -s 'CN=test.example.com,O=EXAMPLE.COM'
3. Copy and paste the CSR (from "-----BEGIN NEW CERTIFICATE
   REQUEST-----" to "-----END NEW CERTIFICATE REQUEST-----") into the
   text area below:
}}}
Note, the '#' is meant to indicate the command prompt. The <em> tag was not quite visible, most likely people won't see the tooltips for key size, so it might be better to mention <key size> explicitly.