Add CA constraint to test CA

Otherwise recent versions of OpenSSL reject it as an invalid CA
certificate (at least once the test certificates are regenerated).

Fixes: #6896

tests/certs/expired/ca/ca.cnf

@@ -4,9 +4,13 @@ prompt = no
 default_md = sha256
 encrypt_key = no
 distinguished_name = dn
+x509_extensions = v3_ca
 
 [dn]
 C = US                            # country code
 O = Python Software Foundation    # organization
 OU = python-requests              # organization unit/department
 CN = Self-Signed Root CA          # common name / your cert name
+
+[v3_ca]
+basicConstraints = critical, CA:true