- Client-Certificates now with extended keyusage
- normal output now through stderr
- public key default through stdin (not for rootca)
- signed cert default through stdout (not for rootca)
- crls now with 31 day lifetime