For one of our customers who is still using IFS Application 10 UPD25, we need to install new IFS environments with new public certificates (rehosting on a new domain).
The problem we are encountering is that certification authorities no longer apply code signing (EKU 1.3.6.1.5.5.7.3.3) to SSL certificates but propose a separate key via HSM or Token.
The customer refuses to use a self-signed certificate.
Has anyone else encountered this type of problem? 
Any ideas? 

Thanks for all support