put x509v3 extensions into client-cert.pem