Проблема с использованием цепочки сертификатов в корде

Я хочу создать собственный центр сертификации и создал rootCertficate, как указано в эту ссылку, используя следующие команды

set RANDFILE=rand
set OPENSSL_CONF=c:\Binaries\openssl-X64\openssl.cnf
openssl req -new -keyout cakey.pem -out careq.pem
openssl x509 -signkey cakey.pem -req -days 3650 -in careq.pem -out caroot.cer -extensions v3_ca

Затем я использую этот сертификат в качестве корневого для подписи и создания других сертификатов с помощью программы Java.

public static X509Certificate signCertificateSigningRequest(
            PKCS10CertificationRequest jcaPKCS10CertificationRequest, KeyPair keyPair, String requestId,
            X509Certificate serverCert) throws Exception
    {
        SubjectPublicKeyInfo pkInfo = jcaPKCS10CertificationRequest.getSubjectPublicKeyInfo();
        JcaPEMKeyConverter converter = new JcaPEMKeyConverter();
        PublicKey pubKey = converter.getPublicKey(pkInfo);
        X509v3CertificateBuilder certificateBuilder = new JcaX509v3CertificateBuilder(serverCert, new BigInteger("1"), // serial
                new Date(System.currentTimeMillis()),
                new Date(System.currentTimeMillis() + 30L * 365L * 24L * 60L * 60L * 1000L),
                jcaPKCS10CertificationRequest.getSubject(), pubKey
        ).addExtension(new ASN1ObjectIdentifier("2.5.29.19"), false, new BasicConstraints(false)
        // true if it is allowed to sign other certs
        ).addExtension(new ASN1ObjectIdentifier("2.5.29.15"), true, new X509KeyUsage(X509KeyUsage.digitalSignature
                | X509KeyUsage.nonRepudiation | X509KeyUsage.keyEncipherment | X509KeyUsage.dataEncipherment));

        AsymmetricKeyParameter asymmetricKeyParameter = PrivateKeyFactory.createKey(keyPair.getPrivate().getEncoded());
        // ContentSigner sigGen = new BcRSAContentSignerBuilder(sigAlgId,
        // digAlgId).build(asymmetricKeyParameter);
        ContentSigner sigGen = new JcaContentSignerBuilder("SHA1withRSA").build(keyPair.getPrivate());

        X509CertificateHolder x509CertificateHolder = certificateBuilder.build(sigGen);
        Certificate eeX509CertificateStructure = x509CertificateHolder.toASN1Structure();
        // Read Certificate
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509", "BC");
        InputStream is1 = new ByteArrayInputStream(eeX509CertificateStructure.getEncoded());
        X509Certificate signedCertificate = (X509Certificate) certificateFactory.generateCertificate(is1);
        FileSystemUtility.saveCertificate(signedCertificate.getEncoded(), serverCert.getEncoded(), requestId);
        return signedCertificate;
    }

Где корневой сертификат выбирается с помощью:

public static X509Certificate getServerCertificate() throws Exception
    {
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509", "BC");
        return (X509Certificate) certificateFactory.generateCertificate(
                new FileInputStream(new File("C:/Users/varun/Desktop/cert/CA/caroot.cer")));
    }

Но когда я отправляю оба сертификата на стороне получателя, и он пытается его проверить, я получаю следующую ошибку:

Проблема 1

Caused by: java.security.cert.CertPathValidatorException: CA key usage check failed: keyCertSign bit is not set
    at sun.security.provider.certpath.KeyChecker.verifyCAKeyUsage(KeyChecker.java:159) ~[?:1.8.0_131]
    at sun.security.provider.certpath.KeyChecker.check(KeyChecker.java:122) ~[?:1.8.0_131]
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125) ~[?:1.8.0_131]
    at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:219) ~[?:1.8.0_131]
    at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140) ~[?:1.8.0_131]
    at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79) ~[?:1.8.0_131]
    at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292) ~[?:1.8.0_131]
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:347) ~[?:1.8.0_131]
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:249) ~[?:1.8.0_131]
    at sun.security.validator.Validator.validate(Validator.java:260) ~[?:1.8.0_131]
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) ~[?:1.8.0_131]
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281) ~[?:1.8.0_131]
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136) ~[?:1.8.0_131]
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1501) ~[?:1.8.0_131]
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) ~[?:1.8.0_131]
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026) ~[?:1.8.0_131]
    at sun.security.ssl.Handshaker$1.run(Handshaker.java:966) ~[?:1.8.0_131]
    at sun.security.ssl.Handshaker$1.run(Handshaker.java:963) ~[?:1.8.0_131]
    at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_131]
    at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1416) ~[?:1.8.0_131]
    at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1268) ~[netty-all-4.1.9.Final.jar:4.1.9.Final]
    at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1176) ~[netty-all-4.1.9.Final.jar:4.1.9.Final]

Проблема 1 решена

Проблема 2

Caused by: java.security.SignatureException: Signature does not match.
at sun.security.x509.X509CertImpl.verify(X509CertImpl.java:449) ~[?:1.8.0_131]
at sun.security.provider.certpath.BasicChecker.verifySignature(BasicChecker.java:166) ~[?:1.8.0_131]
at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:147) ~[?:1.8.0_131]
at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125) ~[?:1.8.0_131]
at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:219) ~[?:1.8.0_131]
at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140) ~[?:1.8.0_131]
at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79) ~[?:1.8.0_131]