Per RFC 5280 4.2.1.9 if the 'cA' field is set to true, the extension must be marked critical. Signed-off-by: Darren Krahn <dkrahn@google.com>