The deployment tool has been modified to generate CSR with basic constraints and key usage extensions for the externally-signed CA signing certificate. The ConfigurationUtils.handleCertRequest() has been modified to throw an exception on error during CSR generation instead of silently ignoring it. The method has also been renamed to generateCertRequest() for clarity. https://fedorahosted.org/pki/ticket/2312 -- Endi S. Dewata