new purpose getting function. Update the ca-cert.pem and pca-cert.pem "CA" certificates so they really are CA certificate: that is they have the appropriate extensions.