certificate_authority_policy: strict
certificate_authority_unique_subject: no