Do stricter validation of CA certificates
    
    Every CA certificate must have non-empty subject and basic constraints
    extension with the CA flag set.
    
    https://fedorahosted.org/freeipa/ticket/4477
    
    Reviewed-By: Petr Viktorin <pviktori@redhat.com>