docs: public static X509Certificate newIntermediateX509CertificateV3(KeyPair keyPair, X500Name issuer,
  		BigInteger serial, Date notBefore, Date notAfter, X500Name subject,
  		String signatureAlgorithm, X509Certificate caCert) throws NoSuchAlgorithmException,
  		CertIOException, OperatorCreationException, CertificateException
  	{
  		X509v3CertificateBuilder certBuilder = new JcaX509v3CertificateBuilder(issuer, serial,
  			notBefore, notAfter, subject, keyPair.getPublic());
  
  		JcaX509ExtensionUtils extensionUtils = new JcaX509ExtensionUtils();
  		certBuilder.addExtension(Extension.authorityKeyIdentifier, false,
  			extensionUtils.createAuthorityKeyIdentifier(caCert));
  		certBuilder.addExtension(Extension.subjectKeyIdentifier, false,
  			extensionUtils.createSubjectKeyIdentifier(keyPair.getPublic()));
  		certBuilder.addExtension(Extension.basicConstraints, true, new BasicConstraints(0));
  		certBuilder.addExtension(Extension.keyUsage, true,
  			new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));
  		ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm)
  			.setProvider(SecurityProvider.BC.name()).build(keyPair.getPrivate());
  		return new JcaX509CertificateConverter().setProvider(SecurityProvider.BC.name())
  			.getCertificate(certBuilder.build(signer));
  	}