When loading certificates verify that it is X.509 v3
    
    Simple version enforcement. A v1 certificate won't have the
    extensions that are assumed available later during the validation
    process.
    
    https://pagure.io/freeipa/issue/8817
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>