anchor.diff:  subjectKeyIdentifier   = hash
   authorityKeyIdentifier = keyid,issuer:always
   extendedKeyUsage       = serverAuth
  -keyUsage               = digitalSignature, keyEncipherment".+keyUsage               = digitalSignature, keyEncipherment
  +subjectAltName         = @alt_names
  +
  +[ alt_names ]
  +DNS.1                  = " ++ str_utils:to_list(Hostname).
  
positive.code: x509_extensions        = server_cert
  default_days           = 3650
  default_crl_days       = 30
  default_md             = sha1
  preserve               = no
  policy                 = policy_anything
  
  
negative.code:     CertPath :: file:filename_all(), Hostname :: string() | binary(),
      CaKeyPath :: file:filename_all(), CaCertPath :: file:filename_all()) -> ok.
  create_signed_webcert(KeyPath, CertPath, Hostname, CaKeyPath, CaCertPath) ->
      {Root, ConfigFile} = create_temp_ca_dir(Hostname),
      CsrPath = filename:join(Root, "temp.csr"),
      create_key(KeyPath),
      create_csr(KeyPath, CsrPath, Hostname),
  