[root]
keyUsage=critical, keyCertSign
basicConstraints=critical, CA:TRUE, pathlen:0
[leaf]
extendedKeyUsage = clientAuth, serverAuth
subjectAltName = IP:127.0.0.1,IP:::1,DNS:localhost
[root_bad]
keyUsage=critical, cRLSign
basicConstraints=critical, CA:TRUE, pathlen:0