We need to set the issuer of the CA, and sign the cert after we set the extensions.