Under profiles.<profile>, add the following Entrust Certificate Authority-specific settings.

See Allowing server-generated verification keys for how to enable PKCS #12 generation on Entrust Certificate Authority.