OpenSSL 3.x requires Subject Key Identifier, Authority Key Identifier,
and Key Usage (keyCertSign) extensions for CA certificate chain
validation. The test certificate generator was missing these, causing
test failures on systems with OpenSSL 3.x.
Co-authored-by: Vladislav Tatjanin <l27001@altlinux.org>