default to -1 for roles that does not exist
added roles to CA issuing certificates