Make openssl accept the right set of KU/EKUs
Make openssl accept the right set of KU/EKUs

Signed-off-by: Peter Jones <2e0a021e603479ff81838c00c3b770daca4e0214@redhat.com>
Upstream: pr#211

rhinstaller/shim,rhinstaller/shim,rhinstaller/shim