Follow CAFB guidelines more closely?

[njsmith]

There are a bunch of ways we aren't really following CAFB rules. Not sure how much it matters. But for example:

7.1.2.1 rules for root certificates:

• SHOULD NOT set path_length
• MUST include keyUsage
  • MUST be marked critical
  • MUST have keyCertSign and cRLSign set

7.1.4.3 CA certificates:

• MUST have a common name, organization name, and country name

7.1.2.3 subscriber certificates:

• MUST have certificatePolicies
• MUST have extKeyUsage

We might have some RFC 5280 fails too, I haven't read it carefully.

[pquentin]

There was some progress in #30 with fdcfbf8 (and 684854b):

• keyUsage and extKeyUsage are now set.
• however, path_length is now incorrectly set on root CAs, sorry about that.

[pquentin]

Using a tool like https://github.com/globalsign/certlint could help!

[graingert]

#328 sets EKU and KU now