- add BasicConstraints CA:TRUE for a ca cert, false for the others