build: default key usage for CA certificates

jobs/credhub/spec

@@ -285,6 +285,9 @@ properties:
                  every certificate is created with at least this
                  value."
     default: 0
+  credhub.certificates.enable_default_ca_key_usages:
+    description: "Enables the setting of default key usage (keyCertSign, cRLSign) for CAs."
+    default: false
 
   # Swappable Backend
   credhub.backend.enable_swappable_backend:

jobs/credhub/templates/application_server.yml.erb

@@ -28,6 +28,7 @@
     },
     'certificates' => {
       'concatenate_cas' => p('credhub.certificates.concatenate_cas'),
+      'enable_default_ca_key_usages' => p('credhub.certificates.enable_default_ca_key_usages'),
       'ca_minimum_duration_in_days' => p('credhub.certificates.ca_minimum_duration_in_days'),
       'leaf_minimum_duration_in_days' => p('credhub.certificates.leaf_minimum_duration_in_days')
     }

spec/credhub/application_server_yml_spec.rb

@@ -137,6 +137,22 @@
       end
     end
 
+    context 'when enable_default_ca_key_usages is true' do
+      it 'sets server property to true' do
+        manifest = {
+          'credhub' => {
+            'certificates' => {
+              'enable_default_ca_key_usages' => true
+            }
+          }
+        }
+
+        rendered_template = YAML.safe_load(template.render(manifest))
+
+        expect(rendered_template['certificates']['enable_default_ca_key_usages']).to eq(true)
+      end
+    end
+
     context 'when enable_swappable_backend is true' do
       it 'sets server property to true, sets socket file, and tls connection properties' do
         manifest = {