1 2 3 4 5
basicConstraints = critical, CA:true keyUsage = cRLSign, keyCertSign subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always