issuer:ca-all-usages
subject:ee-keyCertSign-only
extension:keyUsage:keyCertSign