Don't add the TS EKU by default in openssl.cnf because it then
makes certificates genereated by ca, CA.pl etc useless for anything else.

apps/openssl.cnf

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index 2995800..7bcaa53 100644
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -212,7 +212,7 @@
 #nsSslServerName
 
 # This is required for TSA certificates.
-extendedKeyUsage = critical,timeStamping
+# extendedKeyUsage = critical,timeStamping
 
 [ v3_req ]