8.3: nbcertcommand -signCertificate fails on solaris with "-noPrompt" not valid when used with ...

Hi,

I'm in the middle of upgrading my 8.1.2 Solaris 10 and 11 Sparc clients to v8.3, but because some/most of the clients are behind firewalls or in the DMZ, I can't seem to run the nbcertcmd on them to get a certificate.  So now I'm trying to do the dance of:

on client:

nbcertcmd -createCertRequest -requestFile /tmp/cert-req -server nbu-server

then I copy the /tmp/cert-req file to my "nbu-server" and run on the "nbu-server" (which is running: Solaris 11.2 sun4v sparc) the nbcertcmd to sign the request, but the **bleep** thing fails.

# /usr/openv/netbackup/bin/nbcertcmd -signCertificate -validFor 2D -requestFile /tmp/cert-req -certificateFile /tmp/cert-signed
Option '-noPrompt' is not valid when used with operation '-signCertificate'.

Option '-file' or '-validFor' is mandatory to complete operation '-signCertificate'.

Usage: nbcertcmd -signCertificate
-validFor | -file <authorization_token_file>
-requestFile <request_file_name>
-certificateFile <certificate_file_name>
Description:
Reads the certificate signing request from the specified request file and sends
it to the master server to get a NetBackup CA-signed certificate. The signed
certificate is stored in the specified certificate file. The command must be
executed on the NetBackup host that has connectivity with the master server.

Options:
-certificateFile certificate_file_name
Specifies the path of the certificate file.
-file authorization_token_file
Path of the file containing authorization token on the first line.
-requestFile request_file_name
Specifies the path of the certificate request file.
-token
Indicates that an authorization token is used for the request. Prompts the user
to securely specify a token.

EXIT STATUS 20: invalid command parameter

I don't use the "-noPrompt" flag anywhere.  And I can't figure out how to make this work.  Do I really need to also regenerate a token for this client?  I have to say that this entire move to security has been a total pain in the ass, because it's makes things so fragile.  I wish I could just turn this off for internal only hosts.