KU_CRL_SIGN
if (ku_reject(x, KU_CRL_SIGN))
!(issuer->ex_kusage & KU_CRL_SIGN)) {
if (X509_get_key_usage(x) != (KU_KEY_CERT_SIGN | KU_CRL_SIGN)) {