extend the built-in default certificate profile to configure
conditional extension and subject dn