Extend mkcert.sh to support nameConstraints generation and more complex