revert to require ext_key_usage to be either empty or any in CA cert
adjust to current certificate change