I want to sign an X509 certificate whose keys I cannot access directly(stored in KMS/HSM). I thought of a way to sign the certificate with any random private key so that the certificate can be generated successfully, after that, I can pass the payload of the certificate to the KMS/HSM for signing, and the signature that will be given will be set in the previously created certificate. But I am not able to do so. Can someone help me how to achieve this with the java code?