1basicConstraints = critical, CA:true 2keyUsage = cRLSign, keyCertSign 3subjectKeyIdentifier = hash 4authorityKeyIdentifier = keyid:always 5 6