Self-signed must be CA