Verify X509 properties of trusted certificates

This should resolve https://github.com/opscode/chef/issues/1944.

I'd like to specifically request a good look at the documentation on generating certificates/self-signed certificates/subjectAltNames from @opscode/client-engineers 

@jamescott How can I leave a note for you to let me know when certain documentation has been published to the docs site?
I *think* this should be `CA:TRUE`. Again, hard to tell because handling of v3 attributes might be different on different OpenSSL versions, so we'd need to check a variety of versions to see if this could be a problem.