Update test CA to issue leafs from intermediate CA

[reinkrul]

In production, certificates will be issued by an intermediate CA, which will most probably be used as ca-fingerprint. To properly test selection and validation of ca-fingerprint, the test CA should include an intermediate CA which is used to issue the leaf certificates.