Don't use pre-EL6 extensions
    
    Don't generate the end-entity certificate using extensions that the EL5
    version of OpenSSL's x509 command doesn't print, but which later
    versions do, which causes the comparison to break.