Add Key Encipherment bit to Key Usage extension

Google Chrome rejects the certificate for SSL connections if the Key Usage extension does not include the keyEncipherment purpose.

pkg/issuer/ca/issue.go

@@ -110,7 +110,7 @@ func createCertificateTemplate(publicKey interface{}, commonName string, altName
 		NotBefore: time.Now(),
 		NotAfter:  time.Now().Add(certificateDuration),
 		// see http://golang.org/pkg/crypto/x509/#KeyUsage
-		KeyUsage: x509.KeyUsageDigitalSignature,
+		KeyUsage: x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
 		DNSNames: altNames,
 	}
 	return cert, nil