Run pki client-cert-request command
pki -d /tmp/nssdbI -c Secret123 -p 20080 client-cert-request
"UID=Foo4,E=Foo4@example.com" --extractable 123

[root@pki1 ~]# pki -d /tmp/nssdbI -c Secret123 -p 20080 client-cert-request
"UID=Foo4,E=Foo4@example.com" --extractable 123
-----------------------------
Submitted certificate request
-----------------------------
  Request ID: 44
  Type: enrollment
  Request Status: pending
  Operation Result: success

It should throw proper error message for boolean value.

[root@pki1 ~]# pki client-cert-request --help
usage: client-cert-request [Subject DN] [OPTIONS...]
    --algorithm <algorithm name>   Algorithm (default: rsa)
    --attribute-encoding           Enable Attribute encoding
    --curve <curve name>           ECC key curve name (default: nistp256)
    --extractable <boolean>        Extractable
    --help                         Show help options
    --length <key length>          RSA key length (default: 1024)
    --password                     Prompt password for request
                                   authentication
    --permanent                    Permanent
    --profile <profile>            Certificate profile (RSA default:
                                   caUserCert, ECC default: caECUserCert)
    --sensitive <boolean>          Sensitive
    --ssl-ecdh                     SSL certificate with ECDH ECDSA
    --transport <path>             PEM transport certificate
    --type <request type>          Request type (default: pkcs10)
    --username <username>          Username for request authentication
    --without-pop                  Do not include Proof-of-Possession in
                                   CRMF request