Verify X509 properties of trusted certificates

This should resolve https://github.com/opscode/chef/issues/1944.

I'd like to specifically request a good look at the documentation on generating certificates/self-signed certificates/subjectAltNames from @opscode/client-engineers 

@jamescott How can I leave a note for you to let me know when certain documentation has been published to the docs site?
Also, based on a comment in #1700 it seems like the `keyUsage` field must contain `keyCertSign`. The user reported that leaving the `keyUsage` field commented in openssl.conf worked as well. Worth calling this out because http://stackoverflow.com/questions/21488845/how-can-i-generate-a-self-signed-certificate-with-subjectaltname-using-openssl is one of the top google hits for generating a cert with a SAN, and it has incorrect advice about the contents of this field.