extend the CertProfile so that one can specify different AKI for
selfsigned and not selfsigned certificate in the same certprofile