Under profiles.<profile>, add the following Entrust Certificate Authority-specific settings.

See Allowing CA-side key pair generation on Entrust CA for how to enable PKCS #12 generation on Entrust Certificate Authority.