(Root-CA) Certificates: Fix OpenSSL 3 compatibility

Legacy config was fine for older more lenient OpenSSL versions, but now we actually have to comply. ^^

Keywords for people googling these issues: RFC 5280, basicContraints, "CA:True", keyUsage, extendedKeyUsage, "unsuitable certificate purpose".

• https://docs.openssl.org/3.6/man5/x509v3_config/#standard-extensions
• https://linux.die.net/man/5/x509v3_config
• https://stackoverflow.com/questions/53881437/invalid-ca-certificate-with-self-signed-certificate-chain