extend the CA to consider certificate profiles with special behavior