cert/openssl.cnf: Split CSR and self-signed extensions into separate sections (see...