SSL certificate needs digitalSignature,keyEncipherment keyUsages too

OpenSSL doesn't check this, but NSS does