basicConstraints       = critical, CA:TRUE
subjectKeyIdentifier   = hash
keyUsage               = critical, digitalSignature, keyCertSign, cRLSign

# authorityInfoAccess    = OCSP;URI:http://ocsp.example.com, caIssuers;URI:http://cert.example.com

# certificatePolicies    = 2.23.140.1.2.1, @cps_policy
# cps_policy.id          = 1.3.6.1.4.1.44947.1.1.1
# cps_policy.CPS.1       = http://cps.example.com
