[#3620] Updated test CA

src/lib/asiolink/testutils/ca/doc.txt

@@ -12,6 +12,8 @@ Some critical details:
   but Botan and other algorithms require PKCS#8
  - some tools check the alternate subject name of the server so put
   a correct value in it
+ - some tools require an autority key identifier in all certificates
+  and the basic constraint to be critical
 
 Files:
  - doc.txt this file
@@ -43,7 +45,8 @@ Files:
  - server-addr-conf.cnf OpenSSL configuration file to add an IP address
   subject alternative name (127.0.0.1 and ::1)
  - server-conf.cnf OpenSSL configuration file to add a DNS subject
-  alternative name (localhost)
+  alternative name (localhost), make the basic constraint critical and
+  add cert sign key usage for CAs.
 
 NOTE: On some systems, the openssl pkcs8 commands require -topk8 parameter.
 

src/lib/asiolink/testutils/ca/kea-ca.crt

@@ -1,30 +1,31 @@
 -----BEGIN CERTIFICATE-----
-MIIFMzCCAxugAwIBAgIJAJHdRK24tsELMA0GCSqGSIb3DQEBCwUAMDAxCzAJBgNV
-BAYTAlVTMRAwDgYDVQQKDAdJU0MgSW5jMQ8wDQYDVQQDDAZrZWEtY2EwHhcNMjEw
-MzAyMTQ1OTM3WhcNMzEwMjI4MTQ1OTM3WjAwMQswCQYDVQQGEwJVUzEQMA4GA1UE
-CgwHSVNDIEluYzEPMA0GA1UEAwwGa2VhLWNhMIICIjANBgkqhkiG9w0BAQEFAAOC
-Ag8AMIICCgKCAgEAvKQ/vJpJnXjZ+/LxZNfPc/QYSChSEQ8qoxh8prBYvPXyDu9O
-RHOaDtd5AWusQLCI3iNYMDaJwrazj0g91jPKcxfvFZbnzFHTAZrDnmJwcTw96Ufr
-P4b7PyXpUSF1/YfDf+/M3C7Wm9IJ/e704XHln/vFCw2dR/N5VOrXXJRcCd5NOES/
-ICXexe62Mv7OjUQS8u6ovejtaaMkvoV2hGSG2LXdgVOCv0U8ybRs03Xl8BVM4lFY
-VO9HjnQ7O9AeGMqebvuyNAyGK9Dv+ERu65M9hB+pW//d+tVv3Dkfou+d5cOXPFXj
-f6vIK+2ClxkBH4A5dhsRJ7vPI41mwXA+H0g+MzxJ8Lg0pzJuLher03RZq3pBHvEc
-/jekP4u6mPrc+5J84jQ0hFwH4XIpxaKJsUiE/r1nFDiWRV27PgXMQgEbjdotxFX4
-IDBNKPtQNrybxiQHsYoZPdKcEfh8XyVT4NHrcbqN1SNf2ZIfDkm09aeDYXDdINAD
-+0yZE+3YMeH4oWPpOIfW4OVzEDyfBGHyo2klTZfI5zdd54Kp4dKkzSlmIPC7Oubd
-ZZGoSlZfUlWVcRkqMbUAsZ8H2sdz0l+4k8+VmyiA4EWAiO6SV5xmYSncPQIN5dE2
-PbIxjKosl9JGhajs2gxCqlK+ZA3zgoFHhG1mKGWW7ucMic8Jy4oEq1XsoI0CAwEA
-AaNQME4wHQYDVR0OBBYEFA2rYljxKlzKLA/dsiAmRtO876ifMB8GA1UdIwQYMBaA
-FA2rYljxKlzKLA/dsiAmRtO876ifMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEL
-BQADggIBAGqY1cv913Hj1+FDmD5fhzW6D/SeyL/vh3bCJ6ZJmnHFXxHZbK4lufdi
-v3HRJ4iSPnU40ZWVukWE+vKrZOJeBM2ip/cqv8iAiZg2NaQ56AcDgrpOfJcXOJzD
-83kZI8W3dF/zk1flJM3rsi5QlwkCaxBvwA+QInejN+oncA90CphumNqblPQp1Ifm
-dt+b1BIk6QJFYT0oEXnNj+5EmSu+zJ+fR5bJoZX0YTcP6YAHjdZo2qAHTeM6yX8s
-bLnX97IopyPZ/xgG2kdlp2TZZdeysaICOZ16LldE7fp2OD2ifjrAqF9eezwa2ybi
-wNhduRUn0Nmuw/Vy3X5l3gUekc3mS9br8ooHy6N+8pnq04gGWK3AAZLY5v7uvzmD
-BC6eA0IJAvLyeiuTpBlkHZTFxk7ENaStEMFjvPiLrgquHLmJQzsgKoUtR7TGdEJ+
-DOeLAhuXjpaZ/kefSODmm09BP0d/q3iFU3gp1xGu2svUK0/BC6NQNuTIIap+L/I+
-tKq+SpPpp7laJ7M04TqAlI+EMQ4KFRDbmlWAy5uq/ynEpEJ1FFuyg6Zo+fxracTR
-ytP3p/LUEYl1VQbtn9IEcrkzZNEshBglRSJ09u1nLccy3WoX03P0iQiF4oNCEPMg
-PdPlvvf1t3FbcEn5AFOsMRW4U7MBPD/gvy0EVuEJ/boydq8qMzyi
+MIIFUDCCAzigAwIBAgIUV8rsECY+0ZsGa2VU6QXt9gqQgLYwDQYJKoZIhvcNAQEL
+BQAwMTELMAkGA1UEBhMCVVMxETAPBgNVBAoMCElTQyBJbmMuMQ8wDQYDVQQDDAZr
+ZWEtY2EwHhcNMjQxMDE1MTMxMTQyWhcNMzQxMDEzMTMxMTQyWjAxMQswCQYDVQQG
+EwJVUzERMA8GA1UECgwISVNDIEluYy4xDzANBgNVBAMMBmtlYS1jYTCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBALykP7yaSZ142fvy8WTXz3P0GEgoUhEP
+KqMYfKawWLz18g7vTkRzmg7XeQFrrECwiN4jWDA2icK2s49IPdYzynMX7xWW58xR
+0wGaw55icHE8PelH6z+G+z8l6VEhdf2Hw3/vzNwu1pvSCf3u9OFx5Z/7xQsNnUfz
+eVTq11yUXAneTThEvyAl3sXutjL+zo1EEvLuqL3o7WmjJL6FdoRkhti13YFTgr9F
+PMm0bNN15fAVTOJRWFTvR450OzvQHhjKnm77sjQMhivQ7/hEbuuTPYQfqVv/3frV
+b9w5H6LvneXDlzxV43+ryCvtgpcZAR+AOXYbESe7zyONZsFwPh9IPjM8SfC4NKcy
+bi4Xq9N0Wat6QR7xHP43pD+Lupj63PuSfOI0NIRcB+FyKcWiibFIhP69ZxQ4lkVd
+uz4FzEIBG43aLcRV+CAwTSj7UDa8m8YkB7GKGT3SnBH4fF8lU+DR63G6jdUjX9mS
+Hw5JtPWng2Fw3SDQA/tMmRPt2DHh+KFj6TiH1uDlcxA8nwRh8qNpJU2XyOc3XeeC
+qeHSpM0pZiDwuzrm3WWRqEpWX1JVlXEZKjG1ALGfB9rHc9JfuJPPlZsogOBFgIju
+klecZmEp3D0CDeXRNj2yMYyqLJfSRoWo7NoMQqpSvmQN84KBR4RtZihllu7nDInP
+CcuKBKtV7KCNAgMBAAGjYDBeMB0GA1UdDgQWBBQNq2JY8SpcyiwP3bIgJkbTvO+o
+nzAfBgNVHSMEGDAWgBQNq2JY8SpcyiwP3bIgJkbTvO+onzAPBgNVHRMBAf8EBTAD
+AQH/MAsGA1UdDwQEAwICBDANBgkqhkiG9w0BAQsFAAOCAgEAIleaZXqPRyYKHrRh
+pECNFGT37pJSwzIPw/+28OoRMFTljD+/CoOayoulXG7lL4gag5FXBbTJ8xTVXjJ9
+em8hm+GpVFtJWcXat44j+rPQLSxEzc45X1JM6p/2XXchScdAoKEROKDLYu4ysd00
+B/Ajz6Ym90AoS0y7dW0O1DTFe+iim1vGX7i2OUhGViHZzygM/YVmbxpNeBMw/F2t
+WoCJrrcdPEOxKZXY5Gh+Frf3erU3MrJUAQXYORgBoqXxgV6sLe73i7LqzTvwLoux
+yHN174CjFMVJq4CrpLigVRE6Trq1S2F4eJvFh3yIrXaPyQ4QGFxA9Tph0Se1oO/j
+hlIEpz7nWEkom+G74k+B9/4an4UjrV0uray6EsEpriNjwWEdsxf4rbYV7XztFWqO
+6fQzGOl7wPRxpxBh1fU4qBvj7IqsGLOS6GwInW18WaHhYEzw7KAdM20KYwXjYOO1
+/zDP4IWx1jJE/DqjPicxedKo+eQGp2hG9xc0LBMWYIbMvGYVOzRKPyJaTNl7a6Ij
+xTVXw02mLV4yqXrFzvHI8SSOnU3EqvNRBAF23tpEEcA9xClMPKRHyThBAhRdlu40
+w5PHovX3cA1W/00kOyVlqC2k/i0a7Df1s3CkM/wwrOkjA+0F4cAd8DNEBQok2rsR
+qQlBXVW7lldIeGZLiLmCiKGCWyA=
 -----END CERTIFICATE-----

src/lib/asiolink/testutils/ca/kea-client.crt

@@ -1,23 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIID3TCCAcWgAwIBAgIBCjANBgkqhkiG9w0BAQsFADAwMQswCQYDVQQGEwJVUzEQ
-MA4GA1UECgwHSVNDIEluYzEPMA0GA1UEAwwGa2VhLWNhMB4XDTIxMDMwMjE1MDAz
-M1oXDTMxMDIyODE1MDAzM1owNDELMAkGA1UEBhMCVVMxEDAOBgNVBAoMB0lTQyBJ
-bmMxEzARBgNVBAMMCmtlYS1jbGllbnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
-ggEKAoIBAQDKbsDkElojvFhVt234GQOEVVudEp4s8KYnDQTZpsdeidrP3yY+qWfz
-G1k16qMB5jXF7dRhzq4FiPbZMs5cz3BfwZDlxjWMxgixPaCrVphYLGhI8AOne8PE
-l47e4Ae3Cl96dWUfQKQmGIzzHfTcJvCxUOCob5zYOCDvtjk48IxdvHi18Ab/hXyG
-JKXSuqCsaXBRK7Amn8/jxMgdhds92tNxm0BiAJtsmkQm9QW8ztcoiEEgO4ViDRJS
-RKaG9hVRrAe4GPisOjUzerADkPX/pchHIqmrTJ9YKhngOfDdiAZY1lkZc1cbM6zq
-qTgTp1MvttSv8JEN6OMhM+bpCbaiWp4DAgMBAAEwDQYJKoZIhvcNAQELBQADggIB
-AENl7hCBjAft1uC/XAO/yBkkDrTk6R21+mdJMghJ9ojFP33QvYYv0pDNeCZ/IJEK
-G2ML8gFzd2YulF1qzBMuFvESRQyqJMnIWJS8FSEIKEyqj5RMTnVWjFM6V2yGhBA5
-XXAL4CVVNz/NqWV/Ebd1XB1OB/y5uz+ZowpWktHtqCKYhDzDtK600GswMOJ5UsZF
-X6JtkvG86nVfuyOIK3NtMXQE/ptAgwa87hVecu7yY/u6PmRwS7YbVBsh9VplnAsQ
-bLARtTGCWHL3otZaDi81dghHkHYmv1NmaubgKnFffKxJGLCtyHF0pqS7C0v7lLOo
-qOhSd3qaFEU1yWpXCFlyglDnadFQs8pdWIPBngwQC2luF1N7Kppz5zzGF5MHNt+E
-LuPlRAwgs8aRRPsySGYKvtCeNYAgjsbec9f0P7lMEGr+AqbZF9qNbbQQkq0dHrMH
-goazCek3XtlMAYYUdmkqQ5a44XRQUu4FuTVqzCH8nqhkeHcWTwO9BHayUebxiBk8
-njDwLtHiQ8u9TjVf/35UOdqFSxra+wZJPKYbH++82KG6rbEotGp3jv0uxasgiHVL
-qrD3dkQAU8zF7cllsUkRE3Gw4tDaZXkZCawiMfLiGK1FVApXkUnKilASDsaH6i3x
-Ui8LM1F9vbtJnzftTa3yi0FR6Gmi5Mc+R42gpE8xCa4y
+MIIEODCCAiCgAwIBAgIBCjANBgkqhkiG9w0BAQsFADAxMQswCQYDVQQGEwJVUzER
+MA8GA1UECgwISVNDIEluYy4xDzANBgNVBAMMBmtlYS1jYTAeFw0yNDEwMTUxMzEy
+MDNaFw0zNDEwMTMxMzEyMDNaMEoxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApTb21l
+LVN0YXRlMREwDwYDVQQKDAhJU0MgSW5jLjETMBEGA1UEAwwKa2VhLWNsaWVudDCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMpuwOQSWiO8WFW3bfgZA4RV
+W50SnizwpicNBNmmx16J2s/fJj6pZ/MbWTXqowHmNcXt1GHOrgWI9tkyzlzPcF/B
+kOXGNYzGCLE9oKtWmFgsaEjwA6d7w8SXjt7gB7cKX3p1ZR9ApCYYjPMd9Nwm8LFQ
+4KhvnNg4IO+2OTjwjF28eLXwBv+FfIYkpdK6oKxpcFErsCafz+PEyB2F2z3a03Gb
+QGIAm2yaRCb1BbzO1yiIQSA7hWINElJEpob2FVGsB7gY+Kw6NTN6sAOQ9f+lyEci
+qatMn1gqGeA58N2IBljWWRlzVxszrOqpOBOnUy+21K/wkQ3o4yEz5ukJtqJangMC
+AwEAAaNCMEAwHQYDVR0OBBYEFBZgJYcUsTgnCk/oQP3ZjBSLWoN3MB8GA1UdIwQY
+MBaAFA2rYljxKlzKLA/dsiAmRtO876ifMA0GCSqGSIb3DQEBCwUAA4ICAQALXvp5
+q9aLM1M/FNMWeM4YI5mThgfgo1kgGcrOA3VAHvHVZ1FCRfarjyblp+VWgfCk/Zc5
+xZtRrJyxfAHKEYd2GAhRGdFT+Pz0f2RC+/3iPCR9H8tFCandefEG9fQHg48lpmPs
+L1v7r1qOcCYt17b7/SIlA8QF/e3rSXtEdaGaixabv5V0+f7ZJ5tXNKFx3zvRQKS5
+RqFev/vK+BUqLu62+M0skX1lUpFeI8fr5tK3dhcZJ6nLMZn+Khwv70r2ioxyKGlU
+vmgJD/CLsQPM7vxSZRiAmJgqWwKIZqD72422sFVXP+sjMX4lzyhL3ZDt+GkN5pkA
+an2LnyopJDk+vc4flmDv5gYeXvbSX/MGH4y3SPa/Svcvv85MhRHQV3c0L+y8aUfL
+jqO7/PmEniuLpsma1Nll98/IsDCFnUiaAyf2DUVDgMKr9ZmEkgfupCUaId3OEzDB
+rI2KftrOnNJSYzwrFqUxYAkIcFa1vKcAYEPFYdGkeZqFrvlV6E8cEh9sBqriVD7G
+4DX5yDYSp44odzC9mkgRyjX4EsCxTcY8ueXbyYhrGcSQcA5Aikvx3fMjt3Xm66/x
+TP1as8NSgaNt2Kd4E2h5dYYcA0zeS76jpMBQ4RAGvtlX6dVNdx5bja6rBMf8kBOf
+hs/Xv8RdwpjR0PVVay9kBVF/PMHfKOtcNDAw5w==
 -----END CERTIFICATE-----

src/lib/asiolink/testutils/ca/kea-client.csr

@@ -1,16 +1,17 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICeTCCAWECAQAwNDELMAkGA1UEBhMCVVMxEDAOBgNVBAoMB0lTQyBJbmMxEzAR
-BgNVBAMMCmtlYS1jbGllbnQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
-AQDKbsDkElojvFhVt234GQOEVVudEp4s8KYnDQTZpsdeidrP3yY+qWfzG1k16qMB
-5jXF7dRhzq4FiPbZMs5cz3BfwZDlxjWMxgixPaCrVphYLGhI8AOne8PEl47e4Ae3
-Cl96dWUfQKQmGIzzHfTcJvCxUOCob5zYOCDvtjk48IxdvHi18Ab/hXyGJKXSuqCs
-aXBRK7Amn8/jxMgdhds92tNxm0BiAJtsmkQm9QW8ztcoiEEgO4ViDRJSRKaG9hVR
-rAe4GPisOjUzerADkPX/pchHIqmrTJ9YKhngOfDdiAZY1lkZc1cbM6zqqTgTp1Mv
-ttSv8JEN6OMhM+bpCbaiWp4DAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAs7Ed
-zY2f2BN33Jd2/XAe3Vl/Jm7JgLN7GnvwzdoM/KewsTsSo0wrgqBU2r36F+W2+/T6
-rN8C0SseFfaURd3CQc66UcGzp4+FKxWIS9loO4P43t6MjBUQ/RiW3IQUAbkMIL52
-CG1HiyyOp7GNtXb861CCu25t82oXeW7WWvWJxaKeAk/hkr7lrVxCcU7XkVY6sDU0
-t4fP3W31p5ZkLUK4qELiZ3iJZLnf/5xaXgJpVlS3E4DUe8tyl3TjayYxroyRj+TT
-D0LWwE65QGygJM2cZrraIvue5kVan4C8XZvO/VvZoakWH/ZkGN8Pis33r8oEfrQL
-SyGt7oTSRYob5MTWmA==
+MIICpzCCAY8CAQAwSjELMAkGA1UEBhMCVVMxEzARBgNVBAgMClNvbWUtU3RhdGUx
+ETAPBgNVBAoMCElTQyBJbmMuMRMwEQYDVQQDDAprZWEtY2xpZW50MIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAym7A5BJaI7xYVbdt+BkDhFVbnRKeLPCm
+Jw0E2abHXonaz98mPqln8xtZNeqjAeY1xe3UYc6uBYj22TLOXM9wX8GQ5cY1jMYI
+sT2gq1aYWCxoSPADp3vDxJeO3uAHtwpfenVlH0CkJhiM8x303CbwsVDgqG+c2Dgg
+77Y5OPCMXbx4tfAG/4V8hiSl0rqgrGlwUSuwJp/P48TIHYXbPdrTcZtAYgCbbJpE
+JvUFvM7XKIhBIDuFYg0SUkSmhvYVUawHuBj4rDo1M3qwA5D1/6XIRyKpq0yfWCoZ
+4Dnw3YgGWNZZGXNXGzOs6qk4E6dTL7bUr/CRDejjITPm6Qm2olqeAwIDAQABoBgw
+FgYJKoZIhvcNAQkHMQkMB2tlYXRlc3QwDQYJKoZIhvcNAQELBQADggEBABvCrgxa
+Tlq05oVJFYQfw1i577yvu4a/XPwe7Gw23LpxZ8hvQsJ8wPh0LHvjYLDDgpuwRfuV
+XTpAn2ejHCLub0XGHSO4Yi3RZKwY4veWFWEvIru9aH/EkCGP6YKL20QGOp7+ZbAz
+ambwYSwnfm1xfZP+LafFx+WexIxod0RuISPCNTsI3HeMUrs6k/OkqfOo8DLPHXjF
+eWLHL6vg3MfEu+3Uqq2bg0DfP7dsfqeBJpXqXWxbxZZqMrB8YNuBflI3Y7hpMzHu
+U0mjKiXfiB1PKd8217xQUdLHayQPfPBQUHLvRWR68vy1lox5XbRCmYUuls0oBg11
+3DYacmuM8kTpy70=
 -----END CERTIFICATE REQUEST-----

src/lib/asiolink/testutils/ca/kea-server-addr.crt

@@ -1,24 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIIECjCCAfKgAwIBAgIBHjANBgkqhkiG9w0BAQsFADAwMQswCQYDVQQGEwJVUzEQ
-MA4GA1UECgwHSVNDIEluYzEPMA0GA1UEAwwGa2VhLWNhMB4XDTIxMDMwMjE1MDE0
-OVoXDTMxMDIyODE1MDE0OVowOjELMAkGA1UEBhMCVVMxETAPBgNVBAoMCElTQyBJ
-bmMuMRgwFgYDVQQDDA9rZWEtc2VydmVyLWFkZHIwggEiMA0GCSqGSIb3DQEBAQUA
-A4IBDwAwggEKAoIBAQC95FGAg3RLyh4FdVogSewbUMq4PMoqougt0FA1+hmsrMMs
-gw3OVpvG7bSHzZj85TTYR0TNqv3w6y3OCUhaKYoVUjQ6aLQC6KdSS/3rjS2Og7SD
-SjIKJYWkksnxY4XiPu+ZlRa5JLdW2GUH4wtaU5nnMALI/JY+jhnaegdpiN+JDEEf
-yvkYm1CIkZqmBZFt7Ij6bzftuOKanPpXUAZ5se9/7N3UuP7MM5zOnfw+ogZRuYC9
-8oKP4gsxLjrBiOMdO8IblZIIb9KSR6vYcAkzZw1wQ+ZCoA6kCSYVDYbjptcHisFe
-H101kHnZT1CTI8Ucquc2fjTQH/EEY0qjJNJhstATAgMBAAGjJTAjMCEGA1UdEQQa
-MBiHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADggIBAAaf
-GIHwgnSo4zo6cIfpzirVpSqjzOrsAqzSswigZdj7dwx959sgSJzZssDf/TA98iXM
-YQEkBao6jPuo8fTlCF0XGCUGAfq/f6Yn1Nhkk0qUdxLrNsEjKPXjISZPaVZllZBR
-+mRMKObn0l86vJ/0zGzPRxH2P5CKg9g3sT8zkg1fGIE/SNr8abZV5Cf3spYQ9PF9
-zQ2TdpgaEGGufKR6VAIJH4CVShMfvBF0qFbzMC7R/CTdSvEBXagWclBT7PqcVGlV
-rK/NB6rt8W8hLQQE6bRunJmkLrmLKLVjFtPZPq5hm3jE8fnGxfzvThiZHTj+oFGw
-KXcbuSvwgYuLKym648V+VDGiDWdpS2dIwQi2JeHTt7Y4P+8dqPfHY7oDy2+67J6o
-ElTXvloGVNCedQtpp9gNrtil5avXrU9HCfD9avYlsn89kqYZ3Ht1GBYPyqeSZDCo
-a+sffazhYPfqFdH0U7wpq6Gf8/JMSAuQmAR2UAwhjoQatqDqEJ3pAFsI3YcQOZqm
-kj3/T0iYkU8YdJkxI2YgVCRRIzTKHkGMVc/iz+C0OJwFeJDuj+dj+EXXtyi3sjhL
-oTQT2y01nW2TPrHqlG3/fQyPx1gKXrij+1uOZJpZcgKE7/YBGByRiUdOyRJ0E6h6
-oimhTLT6mC9wteMiRmj68z5tTC1P0H4nuOU7OqwL
+MIIESzCCAjOgAwIBAgIBHjANBgkqhkiG9w0BAQsFADAxMQswCQYDVQQGEwJVUzER
+MA8GA1UECgwISVNDIEluYy4xDzANBgNVBAMMBmtlYS1jYTAeFw0yNDEwMTUxMzEz
+MjlaFw0zNDEwMTMxMzEzMjlaMDoxCzAJBgNVBAYTAlVTMREwDwYDVQQKDAhJU0Mg
+SW5jLjEYMBYGA1UEAwwPa2VhLXNlcnZlci1hZGRyMIIBIjANBgkqhkiG9w0BAQEF
+AAOCAQ8AMIIBCgKCAQEAveRRgIN0S8oeBXVaIEnsG1DKuDzKKqLoLdBQNfoZrKzD
+LIMNzlabxu20h82Y/OU02EdEzar98OstzglIWimKFVI0Omi0AuinUkv9640tjoO0
+g0oyCiWFpJLJ8WOF4j7vmZUWuSS3VthlB+MLWlOZ5zACyPyWPo4Z2noHaYjfiQxB
+H8r5GJtQiJGapgWRbeyI+m837bjimpz6V1AGebHvf+zd1Lj+zDOczp38PqIGUbmA
+vfKCj+ILMS46wYjjHTvCG5WSCG/Skker2HAJM2cNcEPmQqAOpAkmFQ2G46bXB4rB
+Xh9dNZB52U9QkyPFHKrnNn400B/xBGNKoyTSYbLQEwIDAQABo2UwYzAhBgNVHREE
+GjAYhwR/AAABhxAAAAAAAAAAAAAAAAAAAAABMB0GA1UdDgQWBBRO6P0n5K2q9KMs
+LjKVqJwO7ykA5jAfBgNVHSMEGDAWgBQNq2JY8SpcyiwP3bIgJkbTvO+onzANBgkq
+hkiG9w0BAQsFAAOCAgEApWtIk8brQe0BB46lqEkoVXkLtRzPSw/SXYEnI2qLBkyg
+ba4QH6Gspxx0ktDVGhclSO+Ak7MhFSnwF0b3C/lZwhZPyf4L1oen6IaZYo4pKjt0
+8pyKyeRTiw0rcu5x4RRmrcs25GVm5uFVTDOWX/lQu8r8FSaST4nQWFRKDuBUjmhF
+Sg4L7CNMv83zsAXlVl48UoAlLYx6kFNmu3z1mWVZqqSOKm5nHx6NGaWLuOZrDi9h
+GfQgxSLcg0LSvLTGMwWLQqFoRXJR4THcyp4R+2yeGgHF+Z7ffen6hM9eILc8X/dR
+nftc7tL+3/F8uX86t/RYY6KTw4kjdn36GbH2ge410xTxHTVOYlP17YRHb3IDyvSU
+004uqDPNRGcqY6qmGHkZvKjA47mge9FeKy5SMi5H2nyhrHdhlaQwAZM8QteP8S/E
+8G+gEV6dWcUWgDijz9O9VuNsj35hqtO8OQxKJUuLxSBmjwprUFBhCNDrGiuRT7Qt
+w1DwfQ3IH2ilCIQJrcY8/q6RSH7ewFcJv9pDceXN+kEeVVK4JXZ9eqP6uhlUnPJI
+yoqlZE+eTtzjjfMzy6+qtxRbnhPfvZcEGn0wayG4IduP2l8eCyaMFgXX2SdWrcyB
+FB365uI8IcAts5yFtixmVT3VQJHGS1T8oZnFDIPlhZ20MKPgavx5RZ7xC440oFc=
 -----END CERTIFICATE-----

src/lib/asiolink/testutils/ca/kea-server-addr.csr

@@ -1,17 +1,18 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICyzCCAbMCAQAwOjELMAkGA1UEBhMCVVMxETAPBgNVBAoMCElTQyBJbmMuMRgw
+MIIC4zCCAcsCAQAwOjELMAkGA1UEBhMCVVMxETAPBgNVBAoMCElTQyBJbmMuMRgw
 FgYDVQQDDA9rZWEtc2VydmVyLWFkZHIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
 ggEKAoIBAQC95FGAg3RLyh4FdVogSewbUMq4PMoqougt0FA1+hmsrMMsgw3OVpvG
 7bSHzZj85TTYR0TNqv3w6y3OCUhaKYoVUjQ6aLQC6KdSS/3rjS2Og7SDSjIKJYWk
 ksnxY4XiPu+ZlRa5JLdW2GUH4wtaU5nnMALI/JY+jhnaegdpiN+JDEEfyvkYm1CI
 kZqmBZFt7Ij6bzftuOKanPpXUAZ5se9/7N3UuP7MM5zOnfw+ogZRuYC98oKP4gsx
 LjrBiOMdO8IblZIIb9KSR6vYcAkzZw1wQ+ZCoA6kCSYVDYbjptcHisFeH101kHnZ
-T1CTI8Ucquc2fjTQH/EEY0qjJNJhstATAgMBAAGgTDBKBgkqhkiG9w0BCQ4xPTA7
-MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXgMCEGA1UdEQQaMBiHBH8AAAGHEAAAAAAA
-AAAAAAAAAAAAAAEwDQYJKoZIhvcNAQELBQADggEBADlAkM7Vt3acIbgx9uz/nzEU
-biTUETzQnCU/mJZU+F8nuZtIlH9TAej4oT0J1uBuneGdkgGSm3lONUNxYJ7Uz8dm
-wyudv4cpvtacAzPqZNb0aapX3qD9/lUbXfReoOUmt+asdmF2ncmn3l465ercxtUg
-zhbU5uQUEk7C7f4OZQ3b08yG+tblFhpO7Xm4JD6nJk9iQ6gB4WBUDSr7mdm7PMmV
-T8xesD7lDZVjSdXql9p/6YxJJR3360jycLXeTQbom6gfvsfQcs91yfGHRel2yoDx
-ZBcmjfkYK7mwagpB/QCsZDuC4cxZyFM7lV/ukIysviW7WzrtT9mvfTEcTqmPsPU=
+T1CTI8Ucquc2fjTQH/EEY0qjJNJhstATAgMBAAGgZDAWBgkqhkiG9w0BCQcxCQwH
+a2VhdGVzdDBKBgkqhkiG9w0BCQ4xPTA7MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXg
+MCEGA1UdEQQaMBiHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwDQYJKoZIhvcNAQEL
+BQADggEBACz81As4N5WQv5HliqfZC6xoG7PAbMnF4a0kv+dZRW4n8dE8Zr9KEuYC
+3E3d7xTY53fjeQC42gYzM7aq7WxpmmKlw48UBeA8xaGB+ok/WrrxwtOCf76OZ3SK
+gO1X5EkdyWz20l8njfOPZOHDsca+RQDJtk/6O7Le397XrWQZmPLKUFL0mt8QBVYH
+aSfyFoGkyUEJS8ilIjqCO9R85RQizMegX9UWtjGEWU7NgnTs7TKSEgc1vadQA/RQ
+1gfoi0UuBpdxe6KI7I3B0+KAlZGickQV5/1synnbyEj6Azb6tPxskkENtES+BhOU
+KCdpxjd2XJtiImETTENyJ9u4Wwv7Sg0=
 -----END CERTIFICATE REQUEST-----

src/lib/asiolink/testutils/ca/kea-server-raw.crt

@@ -1,23 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIID4jCCAcqgAwIBAgIBHjANBgkqhkiG9w0BAQsFADAwMQswCQYDVQQGEwJVUzEQ
-MA4GA1UECgwHSVNDIEluYzEPMA0GA1UEAwwGa2VhLWNhMB4XDTIxMDMyMjEyNTcw
-MFoXDTMxMDMyMDEyNTcwMFowOTELMAkGA1UEBhMCVVMxETAPBgNVBAoMCElTQyBJ
-bmMuMRcwFQYDVQQDDA5rZWEtc2VydmVyLXJhdzCCASIwDQYJKoZIhvcNAQEBBQAD
-ggEPADCCAQoCggEBAL3kUYCDdEvKHgV1WiBJ7BtQyrg8yiqi6C3QUDX6GayswyyD
-Dc5Wm8bttIfNmPzlNNhHRM2q/fDrLc4JSFopihVSNDpotALop1JL/euNLY6DtINK
-MgolhaSSyfFjheI+75mVFrkkt1bYZQfjC1pTmecwAsj8lj6OGdp6B2mI34kMQR/K
-+RibUIiRmqYFkW3siPpvN+244pqc+ldQBnmx73/s3dS4/swznM6d/D6iBlG5gL3y
-go/iCzEuOsGI4x07whuVkghv0pJHq9hwCTNnDXBD5kKgDqQJJhUNhuOm1weKwV4f
-XTWQedlPUJMjxRyq5zZ+NNAf8QRjSqMk0mGy0BMCAwEAATANBgkqhkiG9w0BAQsF
-AAOCAgEArTCCoN7IKQ1g9PqrCeZe0sFOPmL8tEfg83bdTnOUF1rcaK5b3E/ktuT2
-b4axEOTLo8OdwBFFdGHn7XcXAWEx9mVeEw3J1X4143FfhzwnU5ZfLvgKx3yY22ZO
-9WUf0sT35aEH8jS9OzqeaGqkgNufCrmNG5TBXnTG8iFVVKqxdaI9EpoiXjLJwOi1
-5ZO3iB04saPPekVA+u0nngG+sx30hjpNu8EDl9u5f04B0cE3iZSvc4/DN4GDBjIn
-eHzAwlP++mDTQ6d9K8h9BRNnqXBwdN+6CbTTB3Mw5DlvHxBSXRf9xIuhWEdiT7kQ
-Ac7tTs9qsC+g56j3N526hVegbnhB9SSlO1gNWhKdWoag51TJQP38d7lrD6YhJIVi
-57idCeEfvGNcrIMr7hbn6nm8q1nd8waE2dX0FMm3WCf3Nj8Zpsj8JxnQj3jQ/Q38
-bHoHVtAvc7W7tAzMHl5R7UufEqP/42lnes4DECQ5WvN+t9l5gErO4svHfeXNFGbM
-nbjVxGeJeiRPGriej8dlD5Ea0WVHOETh77+5p7DdDBir/xLHSbS/QypKnTGixhwB
-Zg5z8CHeepVf5Y+xhteOZwJCjxCTwW43aOEHQ0U7gHke2hNtCagwlbmLBITzJMJL
-HIFvpHfNTLX1ZRU/z/3OJVEfuMRjah5BJZPGuhuJxR47hP0tLJY=
+MIIEJzCCAg+gAwIBAgIBFDANBgkqhkiG9w0BAQsFADAxMQswCQYDVQQGEwJVUzER
+MA8GA1UECgwISVNDIEluYy4xDzANBgNVBAMMBmtlYS1jYTAeFw0yNDEwMTUxMzE5
+NDVaFw0zNDEwMTMxMzE5NDVaMDkxCzAJBgNVBAYTAlVTMREwDwYDVQQKDAhJU0Mg
+SW5jLjEXMBUGA1UEAwwOa2VhLXNlcnZlci1yYXcwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQC95FGAg3RLyh4FdVogSewbUMq4PMoqougt0FA1+hmsrMMs
+gw3OVpvG7bSHzZj85TTYR0TNqv3w6y3OCUhaKYoVUjQ6aLQC6KdSS/3rjS2Og7SD
+SjIKJYWkksnxY4XiPu+ZlRa5JLdW2GUH4wtaU5nnMALI/JY+jhnaegdpiN+JDEEf
+yvkYm1CIkZqmBZFt7Ij6bzftuOKanPpXUAZ5se9/7N3UuP7MM5zOnfw+ogZRuYC9
+8oKP4gsxLjrBiOMdO8IblZIIb9KSR6vYcAkzZw1wQ+ZCoA6kCSYVDYbjptcHisFe
+H101kHnZT1CTI8Ucquc2fjTQH/EEY0qjJNJhstATAgMBAAGjQjBAMB0GA1UdDgQW
+BBRO6P0n5K2q9KMsLjKVqJwO7ykA5jAfBgNVHSMEGDAWgBQNq2JY8SpcyiwP3bIg
+JkbTvO+onzANBgkqhkiG9w0BAQsFAAOCAgEAX6yw0QEQG2evyUxwobcXcdBmo9mN
+Tfj9KcIp42jwIRYHvM4uuc8y6O64VCPxMOsCFK2aTrNiBjmAMYUyfiRHrAxKnl3U
+q3pa4hAyAG3SRwPxx0D/iETwnCjBmyU0suQzBn0d0Ycd8z7rZ/Dvd6OSWNmaM4WV
+h7HJO6ci16qMQAOvVajNTCOHvS/PNlhh9z7rt4xcxnqgNOWZEOlOuBpHZcEq2zdh
+qNVGCdeVpuMe7YU5bm06VmdzYjIQDDR6mE01oIREcY06L+6/fHwQnVyvzLKzS2gl
+6ZI3lFs+DVgPT1Y8OmjkMc44iQpvE7SR61aNqjd2cPrS+NzZlHtLo5bycOunpEpQ
+5VRCJ8YERMxmLtA76XUFZr0aCeC/i5i520zugPIMND61OmMNMVtzl+tEOkn14koT
+ngXQEVi9LXHApuP2J8K6PbbW/4o5Z8lNu+vQVJqo3swUFLnDOog7vjxxn7ml4EAl
+evf3msuwLo/rp/4NeznN1csH6we+GfrVOE4Llpy2nC/uPzF5RhzF6UZEvCEaKbX/
+bkJN87Toc+1A3xU56ICUnkLBEzKXMQbXq1tPkC+SpFH1aEKo5FC2FMtoUEuVQHD4
+uYI+dtOm/Vk/XofPd2zhntR+8uc7qHBWyJzRoxZf9vitgwFCy0uDQAwcLjtMdso3
+oBMQa3Jgl9hCtiQ=
 -----END CERTIFICATE-----

src/lib/asiolink/testutils/ca/kea-server.crt

@@ -1,24 +1,25 @@
 -----BEGIN CERTIFICATE-----
-MIID+DCCAeCgAwIBAgIBFDANBgkqhkiG9w0BAQsFADAwMQswCQYDVQQGEwJVUzEQ
-MA4GA1UECgwHSVNDIEluYzEPMA0GA1UEAwwGa2VhLWNhMB4XDTIxMDMwMjE1MDEy
-N1oXDTMxMDIyODE1MDEyN1owNTELMAkGA1UEBhMCVVMxETAPBgNVBAoMCElTQyBJ
-bmMuMRMwEQYDVQQDDAprZWEtc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-MIIBCgKCAQEAveRRgIN0S8oeBXVaIEnsG1DKuDzKKqLoLdBQNfoZrKzDLIMNzlab
-xu20h82Y/OU02EdEzar98OstzglIWimKFVI0Omi0AuinUkv9640tjoO0g0oyCiWF
-pJLJ8WOF4j7vmZUWuSS3VthlB+MLWlOZ5zACyPyWPo4Z2noHaYjfiQxBH8r5GJtQ
-iJGapgWRbeyI+m837bjimpz6V1AGebHvf+zd1Lj+zDOczp38PqIGUbmAvfKCj+IL
-MS46wYjjHTvCG5WSCG/Skker2HAJM2cNcEPmQqAOpAkmFQ2G46bXB4rBXh9dNZB5
-2U9QkyPFHKrnNn400B/xBGNKoyTSYbLQEwIDAQABoxgwFjAUBgNVHREEDTALggls
-b2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggIBAKYtC4/KKZnTktvWankLnlVact5K
-L0bJT4qCDg/0gj0pj3rofqyOEoGIjZssQtAG/wmJNF6gNisX/1F23BdEdPAsOJQv
-KuRwr4zL3uj2Mkz585Or/iz633LnD8Ibv8KQsKLnJ/UnJikeH5UgxqcU9kA7ymAE
-pzilP23p3bINvyBMwWZUzT3CsYB7PrcRzx3ScZhbhYaN0f8lq83nspXr8U3FyH5U
-NkrgpuqIE9dFPiaY4CsjNIISpYANcVeWwyPKMk/uty3KbzbmDr7ssm1u1MyJjeVP
-jE/Dhq+WTbDGMfqR3gyXBWq7b1ROA7tk9kAMQg91PLAELSB6lRmzfxzrH/wYk6E/
-0gHgpznpDcA68uW/54eX8phJQQp7Ak7csElXjqXDJ1AWA8VVjRXHerOkq0cUWply
-YsJQCkx3jKdLDFfjtKZWVOjc9rGCnph4BfUej/Lt7z7tTr/Yh+oAR+UyowRzdZM/
-RSsui8vVbvKU+bRlyB5qmNR8cSI5oEA+kAs5DXK2bh5v1SGSxVjwKuwwLeu8eCr3
-HUYQMxKi7Y15+BqjbrOZCEfHE4WORkKze1dh9U/UU9h+LVd+TB7jprZc3ZOvuqYP
-Bb+ponHJJaRvHUKD/jL8kHQ7KX79wXNVkrevGcPe8qE1X/xu4ChK5PuDzq2HQPLs
-USYWw/aARNwslhV6
+MIIEOTCCAiGgAwIBAgIBFDANBgkqhkiG9w0BAQsFADAxMQswCQYDVQQGEwJVUzER
+MA8GA1UECgwISVNDIEluYy4xDzANBgNVBAMMBmtlYS1jYTAeFw0yNDEwMTUxMzEy
+NThaFw0zNDEwMTMxMzEyNThaMDUxCzAJBgNVBAYTAlVTMREwDwYDVQQKDAhJU0Mg
+SW5jLjETMBEGA1UEAwwKa2VhLXNlcnZlcjCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAL3kUYCDdEvKHgV1WiBJ7BtQyrg8yiqi6C3QUDX6GayswyyDDc5W
+m8bttIfNmPzlNNhHRM2q/fDrLc4JSFopihVSNDpotALop1JL/euNLY6DtINKMgol
+haSSyfFjheI+75mVFrkkt1bYZQfjC1pTmecwAsj8lj6OGdp6B2mI34kMQR/K+Rib
+UIiRmqYFkW3siPpvN+244pqc+ldQBnmx73/s3dS4/swznM6d/D6iBlG5gL3ygo/i
+CzEuOsGI4x07whuVkghv0pJHq9hwCTNnDXBD5kKgDqQJJhUNhuOm1weKwV4fXTWQ
+edlPUJMjxRyq5zZ+NNAf8QRjSqMk0mGy0BMCAwEAAaNYMFYwFAYDVR0RBA0wC4IJ
+bG9jYWxob3N0MB0GA1UdDgQWBBRO6P0n5K2q9KMsLjKVqJwO7ykA5jAfBgNVHSME
+GDAWgBQNq2JY8SpcyiwP3bIgJkbTvO+onzANBgkqhkiG9w0BAQsFAAOCAgEAoOjV
+25l/i354zDPdhYgsr2AU4F3JawqXylurbAxmdhucI8avcaWQT6kuTNotoifJPTEP
+qR9Aq6yNLv69KFUvc9PtTa+1nGp2DS5VsD+wH7404aPDTiTGfHHJ+TFXa0mA0gbM
+N/r08FPWzTpJd/g+rrXlHX9Medyj9xFGxOT0rQNuGIOkezNlmrujtpgE5DmjERTT
+mR8iQdpcPoh9s4IEsnT/LNYRrmVSmT38d0VzQMHVE+O2cueHhRlOCRpqIECC5WXg
+mGWEvS6sKQQfPlE/WusI6HbCk/+C+Bt9Coysy/fiaoLrLuxjgS4zGXFa0la0+578
+KjAsD3qYgV/V3BqPUPjU3Ux9zUh8ebsbgjz0y8DJrxhsFwSN47GMBMYgt9NK/TH4
+PAhiOSYTWmR//8PAk8PeLLzUORbnNjpK5CAKXVItjw5h0DatqN4L/duuZAiiEpBH
+W6zzvWB1pFjJKuHni0wpg934iF4P1T4qAgcw0z+L7c1QB+5WlVKZPoikrphLRFPU
+gtiQPHw/lfmuHx1uw7jQskLJ3wUBzMTCXRK83NHmMF33KslzxAFf9tmcF9nthgJM
+xNJc0SQhHQdzQUN9blCjrtu6O9yn8wt0YcDNWcg4JOz/dOjLkeDVIENrjwVhssIN
+efh/ZWZdXIiIwwE0BWOAJlEcB2PLeLq6zz1uWTs=
 -----END CERTIFICATE-----

src/lib/asiolink/testutils/ca/kea-server.csr

@@ -1,17 +1,18 @@
 -----BEGIN CERTIFICATE REQUEST-----
-MIICuTCCAaECAQAwNTELMAkGA1UEBhMCVVMxETAPBgNVBAoMCElTQyBJbmMuMRMw
+MIIC0TCCAbkCAQAwNTELMAkGA1UEBhMCVVMxETAPBgNVBAoMCElTQyBJbmMuMRMw
 EQYDVQQDDAprZWEtc2VydmVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
 AQEAveRRgIN0S8oeBXVaIEnsG1DKuDzKKqLoLdBQNfoZrKzDLIMNzlabxu20h82Y
 /OU02EdEzar98OstzglIWimKFVI0Omi0AuinUkv9640tjoO0g0oyCiWFpJLJ8WOF
 4j7vmZUWuSS3VthlB+MLWlOZ5zACyPyWPo4Z2noHaYjfiQxBH8r5GJtQiJGapgWR
 beyI+m837bjimpz6V1AGebHvf+zd1Lj+zDOczp38PqIGUbmAvfKCj+ILMS46wYjj
 HTvCG5WSCG/Skker2HAJM2cNcEPmQqAOpAkmFQ2G46bXB4rBXh9dNZB52U9QkyPF
-HKrnNn400B/xBGNKoyTSYbLQEwIDAQABoD8wPQYJKoZIhvcNAQkOMTAwLjAJBgNV
-HRMEAjAAMAsGA1UdDwQEAwIF4DAUBgNVHREEDTALgglsb2NhbGhvc3QwDQYJKoZI
-hvcNAQELBQADggEBAECqICoEZb0XeGwoBedtG2Exb4RUeoTAfL24q5a8cOtv0+Mw
-i7y9LNihtRqP2kzhoZ7IhzSUZGVuh4BIUywpJHuWfM9b+fe+hxSGdqCeULKS3InK
-4RWRh9jr12L7hEKfAG7VtL03/+Lm5DHLr47X6RkeZ5GwP29qqLwJcrK9qeFi26Bs
-TrEafPInhF7PgyFjH2YVZVotNaOFMRvwEQwAMtuF7SAqRHr+8VHXP3yi9UjHvxRs
-BpbVD6fEWNkLLJhoSqERgjWnsFlU3O+kj9R+iKA+6arxr4d+HS+dyYitFtVJaR6C
-0+De9msTbJmn+2mu4zQ09Sdf0pN5lb/I3pgcbLU=
+HKrnNn400B/xBGNKoyTSYbLQEwIDAQABoFcwFgYJKoZIhvcNAQkHMQkMB2tlYXRl
+c3QwPQYJKoZIhvcNAQkOMTAwLjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DAUBgNV
+HREEDTALgglsb2NhbGhvc3QwDQYJKoZIhvcNAQELBQADggEBAGM6SGJwnAvyUbMT
+B7A+6HxJRu3YUr/WZiMkujPiLe1KxdiaeLltcqZ18Nmrw345kaVJ8vO3BqPKkxAM
+pbjjOqK3S0mmALiaigPX8sDMU0yURrmtoe5keYY+vK3rtWQIzAALvy8yz6yRhARO
+LXlNRLtogr1gy4VPGmn7WwMZSV64TXKYydJSh2GOU1HjvQZriO0NmS+/b6ZFzQph
+F6Zl6FG7WXSBHxMIhcqMtSIH/IKlXMAVt53HgUyvyxKJbf7p5HaLN9onqh3UvCyR
+rwMJanlOiCyOrfsLpAY4mH9ErnhgTcrXcp2BhKdtSk31m7vANseIqIbhednygTE7
+IIV7e98=
 -----END CERTIFICATE REQUEST-----

src/lib/asiolink/testutils/ca/server-conf.cnf

@@ -236,14 +236,17 @@ authorityKeyIdentifier=keyid:always,issuer
 
 # This is what PKIX recommends but some broken software chokes on critical
 # extensions.
-#basicConstraints = critical,CA:true
 # So we do this instead.
-basicConstraints = CA:true
+# basicConstraints = CA:true
+# Do it anyway as some require this!
+basicConstraints = critical,CA:true
 
 # Key usage: this is typical for a CA certificate. However since it will
 # prevent it being used as an test self-signed certificate it is best
 # left out by default.
 # keyUsage = cRLSign, keyCertSign
+# keyCertSign can be required.
+keyUsage = keyCertSign
 
 # Some might want this also
 # nsCertType = sslCA, emailCA