if args.ca:
exts.append(Extension((
("extnID", id_ce_basicConstraints),
- ("extnValue", OctetString(BasicConstraints((("cA", Boolean(True)),)).encode())),
+ ("critical", Boolean(True)),
+ ("extnValue", OctetString(BasicConstraints((
+ ("cA", Boolean(True)),
+ )).encode())),
)))
exts.append(Extension((
("extnID", id_ce_keyUsage),
+ ("critical", Boolean(True)),
("extnValue", OctetString(KeyUsage(("keyCertSign",)).encode())),
)))
if ca_ai is not None: