provide an intermediate CA without basicConstraint, which should fail
provide a server certificate without common name or subject alternative name, which should fail