switch up the options for cert generating, still TODO: serials

ca.js

@@ -66,10 +66,11 @@ function generateCertificate(privateKey, publicKey) {
 	cert.setExtensions([	
 		{
 			name: "basicConstraints",
-			cA: false,
+			cA: true,
 		},
 		{
 			name: "keyUsage",
+			keyCertSign: true,
 			digitalSignature: true,
 			nonRepudiation: true,
 			keyEncipherment: true,
@@ -114,11 +115,10 @@ function verifyCSR(csrPem, allowedDomains) {
 	cert.setExtensions([
 		{
 			name: "basicConstraints",
-			cA: true,
+			cA: false,
 		},
 		{
 			name: "keyUsage",
-			keyCertSign: true,
 			digitalSignature: true,
 			nonRepudiation: true,
 			keyEncipherment: true,