diff --git a/doc/setup.texi b/doc/setup.texi
index 910388b12..69b2b0bc2 100644
--- a/doc/setup.texi
+++ b/doc/setup.texi
@@ -1303,10 +1303,9 @@ hxtool issue-certificate \
     --self-signed \
     --issue-ca \
     --generate-key=rsa \
-    --out-key="ca.key" \
     --subject="CN=CA,DC=test,DC=h5l,DC=se" \
     --lifetime=10years \
-    --certificate="ca.der"
+    --certificate="FILE:ca.pem"
 @end example
 
 The KDC needs to have a certificate, so generate a certificate of the
@@ -1317,13 +1316,12 @@ You need to change --subject and --pk-init-principal in the command below.
 
 @example
 hxtool issue-certificate \
-    --ca-certificate=FILE:ca.der,ca.key \
+    --ca-certificate=FILE:ca.pem \
     --generate-key=rsa \
     --type="pkinit-kdc" \
     --pk-init-principal="krbtgt/TEST.H5L.SE@@TEST.H5L.SE" \
-    --out-key="kdc.key" \
     --subject="uid=kdc,DC=test,DC=h5l,DC=se" \
-    --certificate="kdc.der"
+    --certificate="FILE:kdc.pem"
 @end example
 
 The users also needs to have a certificates, so generate a certificate
@@ -1335,13 +1333,12 @@ You need to change --subject and --pk-init-principal in the command below.
 
 @example
 hxtool issue-certificate \
-    --ca-certificate=FILE:ca.der,ca.key \
+    --ca-certificate=FILE:ca.pem \
     --generate-key=rsa \
     --type="pkinit-client" \
     --pk-init-principal="lha@@TEST.H5L.SE" \
-    --out-key="user.key" \
     --subject="uid=lha,DC=test,DC=h5l,DC=se" \
-    --certificate="user.der"
+    --certificate="FILE:user.pem"
 @end example