pki tool --issue/--verify operations require a CA with CA basicConstraint