...
[ tsa_cert ]
extendedKeyUsage = critical,timeStamping
...