@Test
void generateSelfSignedCertificateVersion3RootCa() throws Exception
{

    CertifiedPublicKey certificate =
        factory.getInstance(signerFactory.getInstance(true, rsaPrivateKey),
            new X509CertificateGenerationParameters(
                builder.addBasicConstraints(true)
                    .addKeyUsage(true, EnumSet.of(KeyUsage.keyCertSign,
                        KeyUsage.cRLSign))
                    .build()))
            .generate(new DistinguishedName("CN=Test"), rsaPublicKey,
                new X509CertificateParameters());
    X509CertifiedPublicKey cert = checkSelfSigned(certificate, 3);
    assertTrue(cert.getExtensions().isCritical(X509Extensions.BASIC_CONSTRAINTS_OID),
        "Basic constraints should be critical.");
    assertTrue(cert.getExtensions().hasCertificateAuthorityBasicConstraints(),
        "Basic constraints should be set to CA.");
    assertTrue(cert.getExtensions().isCritical(KeyUsage.OID), "KeyUsage extension should be critical.");
    assertThat(cert.getExtensions().getKeyUsage(), equalTo(EnumSet.of(KeyUsage.keyCertSign,
        KeyUsage.cRLSign)));
    assertThat(cert.getAuthorityKeyIdentifier(), notNullValue());
    assertThat(cert.getAuthorityKeyIdentifier(),
        equalTo(cert.getSubjectKeyIdentifier()));
}