set Certificate Sign and CRL Sign flags in keyUsage extension if CA is true